matrix | 016061f330faaeffdd84628f613a719a2f617c8145909d047b5721429ee5b451

Analysis

max time kernel
157s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-04-2024 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FoxRansomware/91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
Size

1.2MB
MD5

1fa1b6d4b3ed867c1d4baffc77417611
SHA1

afb5e385f9cc8910d7a970b6c32b8d79295579da
SHA256

91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53
SHA512

0600b92914a7489a6428b8e4217e5f24e1d149fc5807d86cc4de91b43be2470a1ddf77093c8732d4371a87fd163cc556e09d11a2c6655382a35a5f5741ae05a5
SSDEEP

24576:K/SA+2lraRrjSJR5ezmT1dM9bBkNIDreFqO:2Xl9Ife

Score

10^/10

matrix discovery evasion persistence ransomware spyware stealer upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://myexternalip.com/raw

Extracted

Path

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\#FOX_README#.rtf

Ransom Note

{\rtf1\ansi\ansicpg1251\deff0\nouicompat\deflang1049{\fonttbl{\f0\fnil\fcharset0 Calibri;}{\f1\fnil\fcharset204 Calibri;}} {\colortbl ;\red255\green0\blue0;\red0\green77\blue187;\red0\green176\blue80;\red0\green0\blue255;\red255\green255\blue255;} {\*\generator Riched20 10.0.15063}\viewkind4\uc1 \pard\ri-500\sa200\sl240\slmult1\qc\tx8804\ul\b\f0\fs28\lang1033 HOW TO RECOVER YOUR FILES INSTRUCTION\ulnone\f1\lang1049\par \pard\ri-74\sl240\slmult1\tx8378\cf1\f0\fs24\lang1033 ATENTION!!!\par \cf0\b0 We are realy sorry to inform you that \b ALL YOUR FILES WERE ENCRYPTED \par \b0 by our automatic software. It became possible because of bad server security. \par \cf1\b ATENTION!!!\par \cf0\b0 Please don't worry, we can help you to \b RESTORE\b0 your server to original\par state and decrypt all your files quickly and safely!\par \b\par \cf2 INFORMATION!!!\par \cf0\b0 Files are not broken!!!\par Files were encrypted with AES-128+RSA-2048 crypto algorithms.\par There is no way to decrypt your files without unique decryption key and special software. Your unique decryption key is securely stored on our server. For our safety, all information about your server and your decryption key will be automaticaly \b DELETED AFTER 7 DAYS! \b0 You will irrevocably lose all your data!\par \i * Please note that all the attempts to recover your files by yourself or using third party tools will result only in irrevocable loss of your data!\par * Please note that you can recover files only with your unique decryption key, which stored on our side. If you will use the help of third parties, you will only add a middleman.\f1\lang1049\par \i0\f0\lang1033\par \cf3\b HOW TO RECOVER FILES???\par \cf0\b0 Please write us to the e-mail \i (write on English or use professional translator)\i0 :\par \pard\sl240\slmult1\b\fs28 PabFox@protonmail.com \par FoxHelp@cock.li\par FoxHelp@tutanota.com\cf1\fs24\par You have to send your message on each of our 3 emails\f1\lang1049 \f0\lang1033 due to the fact that the message may not reach their intended recipient for a variety of reasons!\fs28\par \pard\ri-74\sl240\slmult1\tx8378\cf0\b0\fs24 \par In subject line write your personal ID:\par \b\fs28 65E3711449E2627A\par \b0\fs24 We recommed you to attach 3 encrypted files to your message. We will demonstrate that we can recover your files. \f1\lang1049\par \i * \f0\lang1033 \f1\lang1049 \f0\lang1033 Please note that files must not contain any valuable information and their total size must be less than 5Mb. \par \i0\par \cf1\b OUR ADVICE!!!\par \cf0\b0 Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.\par \ul\b\par We will definitely reach an agreement ;) !!!\b0\par \ulnone\par \fs20 \par \par \par \par \par \par \par \pard\ri-74\sl240\slmult1\qc\tx8378\b\fs24 ALTERNATIVE COMMUNICATION\par \b0\fs20\par \pard\ri-74\sl240\slmult1\tx8378 \f1\lang1049 If y\'eeu did n\'eet r\'e5c\'e5iv\'e5 th\'e5 \'e0nsw\'e5r fr\'eem th\'e5 \'e0f\'eer\'e5cit\'e5d \'e5m\'e0il\f0\lang1033 s\f1\lang1049 f\'eer m\'eer\'e5 th\f0\lang1033 e\f1\lang1049 n \f0\lang1033 24\f1\lang1049 h\f0\lang1033 o\f1\lang1049 urs\f0\lang1033 please s\f1\lang1049\'e5\f0\lang1033 nd us Bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 s fr\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r thr\f1\lang1049\'ee\f0\lang1033 ugh th\f1\lang1049\'e5\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 bp\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 {{\field{\*\fldinst{HYPERLINK https://bitmsg.me }}{\fldrslt{https://bitmsg.me\ul0\cf0}}}}\f0\fs20 . B\f1\lang1049\'e5\f0\lang1033 l\f1\lang1049\'ee\f0\lang1033 w is \f1\lang1049\'e0\f0\lang1033 tut\f1\lang1049\'ee\f0\lang1033 ri\f1\lang1049\'e0\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 n h\f1\lang1049\'ee\f0\lang1033 w t\f1\lang1049\'ee\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nd bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 vi\f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r:\par 1. \f1\lang1049\'ce\f0\lang1033 p\f1\lang1049\'e5\f0\lang1033 n in y\f1\lang1049\'ee\f0\lang1033 ur br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r th\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_up }}{\fldrslt{https://bitmsg.me/users/sign_up\ul0\cf0}}}}\f0\fs20 \f1\lang1049\'e0\f0\lang1033 nd m\f1\lang1049\'e0\f0\lang1033 k\f1\lang1049\'e5\f0\lang1033 th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n b\f1\lang1049\'f3\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 ring n\f1\lang1049\'e0\f0\lang1033 m\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd.\par 2. \f1\lang1049\'d3\'ee\f0\lang1033 u must c\f1\lang1049\'ee\f0\lang1033 nfirm th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n, r\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd f\f1\lang1049\'ee\f0\lang1033 ll\f1\lang1049\'ee\f0\lang1033 w th\f1\lang1049\'e5\f0\lang1033 instructi\f1\lang1049\'ee\f0\lang1033 ns th\f1\lang1049\'e0\f0\lang1033 t w\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nt t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 u.\par 3. R\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 sit\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e0\f0\lang1033 nd \f1\lang1049\'f1\f0\lang1033 lick \f1\lang1049 "\f0\lang1033 L\f1\lang1049\'ee\f0\lang1033 gin\f1\lang1049 "\f0\lang1033 l\f1\lang1049\'e0\f0\lang1033 b\f1\lang1049\'e5\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 r us\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_in }}{\fldrslt{https://bitmsg.me/users/sign_in\ul0\cf0}}}}\f0\fs20 , \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd \f1\lang1049\'e0\f0\lang1033 nd click th\f1\lang1049\'e5\f0\lang1033 "Sign in" butt\f1\lang1049\'ee\f0\lang1033 n. \f1\lang1049 \f0\lang1033\par 4. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "\f1\lang1049\'d1\f0\lang1033 r\f1\lang1049\'e5\'e0\f0\lang1033 t\f1\lang1049\'e5\f0\lang1033 R\f1\lang1049\'e0\f0\lang1033 nd\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss" butt\f1\lang1049\'ee\f0\lang1033 n.\par 5. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "N\f1\lang1049\'e5\f0\lang1033 w m\f1\lang1049\'e0\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\par \b 6. S\f1\lang1049\'e5\f0\lang1033 nding m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 :\par T\f1\lang1049\'ee\f0\lang1033 :\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss: \b BM-2cXRWRW5Jv5hxbhgu2HJSJrtPf92iKshhm\par \pard\sl240\slmult1 Subj\f1\lang1049\'e5\'f1\f0\lang1033 t:\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur ID: \b 65E3711449E2627A\par M\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 : \b0 D\f1\lang1049\'e5\f0\lang1033 scrib\f1\lang1049\'e5\f0\lang1033 wh\f1\lang1049\'e0\f0\lang1033 t \f1\lang1049\'f3\'ee\f0\lang1033 u think n\f1\lang1049\'e5\f0\lang1033 c\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 r\f1\lang1049\'f3\f0\lang1033 .\par \pard\ri-74\sa200\sl240\slmult1\tx8378\f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "S\f1\lang1049\'e5\f0\lang1033 nd m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\cf5\b\par \pard\sa200\sl240\slmult1\fs28 xeUY0hDT\cf0\f1\fs32\lang1049\par \par }

Emails

PabFox@protonmail.com

FoxHelp@cock.li\par

FoxHelp@tutanota.com\cf1\fs24\par

URLs

https://bitmsg.me

https://bitmsg.me/users/sign_up

https://bitmsg.me/users/sign_in

Signatures

Matrix Ransomware 64 IoCs

Targeted ransomware with information collection and encryption functionality.

ransomware matrix

Processes:

91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe

description	ioc	process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\EDGEMITMP_19EA3.tmp\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\css\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sk-sk\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\tr-tr\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ro-ro\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\Java\jre-1.8\lib\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-gb\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\it-it\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\7-Zip\Lang\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ca-es\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\pt-br\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sv-se\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

4640 bcdedit.exe
6004 bcdedit.exe
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

331 4232 powershell.exe
Drops file in Drivers directory 1 IoCs

Processes:

YYcYgdAC64.exe

description ioc process

File created C:\Windows\system32\Drivers\PROCEXP152.SYS YYcYgdAC64.exe

pid	process
4640	bcdedit.exe
6004	bcdedit.exe

flow	pid	process
331	4232	powershell.exe

description	ioc	process
File created	C:\Windows\system32\Drivers\PROCEXP152.SYS	YYcYgdAC64.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

YYcYgdAC64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS"	YYcYgdAC64.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 3 IoCs

Processes:

NW87G6Z4.exeYYcYgdAC.exeYYcYgdAC64.exe

pid process

1544 NW87G6Z4.exe
5424 YYcYgdAC.exe
2704 YYcYgdAC64.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exe

pid process

2704 takeown.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1544	NW87G6Z4.exe
5424	YYcYgdAC.exe
2704	YYcYgdAC64.exe

pid	process
2704	takeown.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\YYcYgdAC.exe	upx
behavioral10/memory/5424-637-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral10/memory/5424-2736-0x0000000000400000-0x0000000000477000-memory.dmp	upx

Drops desktop.ini file(s) 6 IoCs

Processes:

91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\desktop.ini	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

YYcYgdAC64.exe91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe

description	ioc	process
File opened (read-only)	\??\A:	YYcYgdAC64.exe
File opened (read-only)	\??\J:	YYcYgdAC64.exe
File opened (read-only)	\??\K:	YYcYgdAC64.exe
File opened (read-only)	\??\X:	YYcYgdAC64.exe
File opened (read-only)	\??\Y:	YYcYgdAC64.exe
File opened (read-only)	\??\T:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\L:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\B:	YYcYgdAC64.exe
File opened (read-only)	\??\M:	YYcYgdAC64.exe
File opened (read-only)	\??\Q:	YYcYgdAC64.exe
File opened (read-only)	\??\R:	YYcYgdAC64.exe
File opened (read-only)	\??\U:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\Z:	YYcYgdAC64.exe
File opened (read-only)	\??\G:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\G:	YYcYgdAC64.exe
File opened (read-only)	\??\I:	YYcYgdAC64.exe
File opened (read-only)	\??\W:	YYcYgdAC64.exe
File opened (read-only)	\??\Z:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\V:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\R:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\I:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\E:	YYcYgdAC64.exe
File opened (read-only)	\??\H:	YYcYgdAC64.exe
File opened (read-only)	\??\V:	YYcYgdAC64.exe
File opened (read-only)	\??\Y:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\S:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\Q:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\M:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\H:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\O:	YYcYgdAC64.exe
File opened (read-only)	\??\T:	YYcYgdAC64.exe
File opened (read-only)	\??\U:	YYcYgdAC64.exe
File opened (read-only)	\??\W:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\P:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\O:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\N:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\E:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\N:	YYcYgdAC64.exe
File opened (read-only)	\??\P:	YYcYgdAC64.exe
File opened (read-only)	\??\S:	YYcYgdAC64.exe
File opened (read-only)	\??\X:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\J:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened (read-only)	\??\L:	YYcYgdAC64.exe
File opened (read-only)	\??\K:	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

255 myexternalip.com

flow	ioc
255	myexternalip.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\BvEJRJgL.bmp"	reg.exe

Drops file in Program Files directory 64 IoCs

Processes:

91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql2000.xsl	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_selectlist_checkmark_18.svg	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win11\identity_helper.Sparse.Canary.msix	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Windows.Input.Manipulations.resources.dll	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\management.dll	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CalibriLI.ttf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-default_32.svg	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-ae\ui-strings.js	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\clrjit.dll	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\share.svg	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\hu_get.svg	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ro-ro\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Notifications\SoftLandingAssetLight.gif	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\SalesReport.xltx	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\compare.png	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\TecProxy.dll	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\ui-strings.js	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_ellipses_selected.svg	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\stop_collection_data.gif	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-selector.js	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationProvider.resources.dll	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-PipelineConfig.xml	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-si\ui-strings.js	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\#FOX_README#.rtf	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Text.Encoding.Extensions.dll	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.Native.dll	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\ca-Es-VALENCIA.pak.DATA	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\Analytics.DATA	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\webview2_integration.dll	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\dev.identity_helper.exe.manifest	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\hu.pak	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-MEDIUM.TTF	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DcfMsoWrapper.dll	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile.png	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.Win32.Registry.AccessControl.dll	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-core-file-l1-2-0.dll	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libripple_plugin.dll	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\ui-strings.js	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\oneds.dll	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Threading.AccessControl.dll	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4948 schtasks.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

5916 vssadmin.exe

pid	process
4948	schtasks.exe

pid	process
5916	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

powershell.exeYYcYgdAC64.exe

pid	process
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
2704	YYcYgdAC64.exe
2704	YYcYgdAC64.exe
2704	YYcYgdAC64.exe
2704	YYcYgdAC64.exe
2704	YYcYgdAC64.exe
2704	YYcYgdAC64.exe
2704	YYcYgdAC64.exe
2704	YYcYgdAC64.exe
2704	YYcYgdAC64.exe
2704	YYcYgdAC64.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

YYcYgdAC64.exe

pid process

2704 YYcYgdAC64.exe

pid	process
2704	YYcYgdAC64.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

powershell.exeYYcYgdAC64.exevssvc.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	2704	YYcYgdAC64.exe
Token: SeLoadDriverPrivilege	2704	YYcYgdAC64.exe
Token: SeBackupPrivilege	4428	vssvc.exe
Token: SeRestorePrivilege	4428	vssvc.exe
Token: SeAuditPrivilege	4428	vssvc.exe
Token: SeIncreaseQuotaPrivilege	7068	WMIC.exe
Token: SeSecurityPrivilege	7068	WMIC.exe
Token: SeTakeOwnershipPrivilege	7068	WMIC.exe
Token: SeLoadDriverPrivilege	7068	WMIC.exe
Token: SeSystemProfilePrivilege	7068	WMIC.exe
Token: SeSystemtimePrivilege	7068	WMIC.exe
Token: SeProfSingleProcessPrivilege	7068	WMIC.exe
Token: SeIncBasePriorityPrivilege	7068	WMIC.exe
Token: SeCreatePagefilePrivilege	7068	WMIC.exe
Token: SeBackupPrivilege	7068	WMIC.exe
Token: SeRestorePrivilege	7068	WMIC.exe
Token: SeShutdownPrivilege	7068	WMIC.exe
Token: SeDebugPrivilege	7068	WMIC.exe
Token: SeSystemEnvironmentPrivilege	7068	WMIC.exe
Token: SeRemoteShutdownPrivilege	7068	WMIC.exe
Token: SeUndockPrivilege	7068	WMIC.exe
Token: SeManageVolumePrivilege	7068	WMIC.exe
Token: 33	7068	WMIC.exe
Token: 34	7068	WMIC.exe
Token: 35	7068	WMIC.exe
Token: 36	7068	WMIC.exe
Token: SeIncreaseQuotaPrivilege	7068	WMIC.exe
Token: SeSecurityPrivilege	7068	WMIC.exe
Token: SeTakeOwnershipPrivilege	7068	WMIC.exe
Token: SeLoadDriverPrivilege	7068	WMIC.exe
Token: SeSystemProfilePrivilege	7068	WMIC.exe
Token: SeSystemtimePrivilege	7068	WMIC.exe
Token: SeProfSingleProcessPrivilege	7068	WMIC.exe
Token: SeIncBasePriorityPrivilege	7068	WMIC.exe
Token: SeCreatePagefilePrivilege	7068	WMIC.exe
Token: SeBackupPrivilege	7068	WMIC.exe
Token: SeRestorePrivilege	7068	WMIC.exe
Token: SeShutdownPrivilege	7068	WMIC.exe
Token: SeDebugPrivilege	7068	WMIC.exe
Token: SeSystemEnvironmentPrivilege	7068	WMIC.exe
Token: SeRemoteShutdownPrivilege	7068	WMIC.exe
Token: SeUndockPrivilege	7068	WMIC.exe
Token: SeManageVolumePrivilege	7068	WMIC.exe
Token: 33	7068	WMIC.exe
Token: 34	7068	WMIC.exe
Token: 35	7068	WMIC.exe
Token: 36	7068	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.execmd.execmd.execmd.execmd.execmd.exeYYcYgdAC.exewscript.execmd.execmd.execmd.exe

description	pid	process	target process
PID 440 wrote to memory of 2520	440	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe	cmd.exe
PID 440 wrote to memory of 2520	440	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe	cmd.exe
PID 440 wrote to memory of 2520	440	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe	cmd.exe
PID 440 wrote to memory of 1544	440	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe	NW87G6Z4.exe
PID 440 wrote to memory of 1544	440	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe	NW87G6Z4.exe
PID 440 wrote to memory of 1544	440	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe	NW87G6Z4.exe
PID 440 wrote to memory of 2456	440	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe	cmd.exe
PID 440 wrote to memory of 2456	440	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe	cmd.exe
PID 440 wrote to memory of 2456	440	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe	cmd.exe
PID 2456 wrote to memory of 4232	2456	cmd.exe	powershell.exe
PID 2456 wrote to memory of 4232	2456	cmd.exe	powershell.exe
PID 2456 wrote to memory of 4232	2456	cmd.exe	powershell.exe
PID 440 wrote to memory of 5628	440	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe	cmd.exe
PID 440 wrote to memory of 5628	440	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe	cmd.exe
PID 440 wrote to memory of 5628	440	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe	cmd.exe
PID 440 wrote to memory of 5644	440	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe	cmd.exe
PID 440 wrote to memory of 5644	440	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe	cmd.exe
PID 440 wrote to memory of 5644	440	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe	cmd.exe
PID 5628 wrote to memory of 5832	5628	cmd.exe	reg.exe
PID 5628 wrote to memory of 5832	5628	cmd.exe	reg.exe
PID 5628 wrote to memory of 5832	5628	cmd.exe	reg.exe
PID 5644 wrote to memory of 5844	5644	cmd.exe	wscript.exe
PID 5644 wrote to memory of 5844	5644	cmd.exe	wscript.exe
PID 5644 wrote to memory of 5844	5644	cmd.exe	wscript.exe
PID 5628 wrote to memory of 5920	5628	cmd.exe	reg.exe
PID 5628 wrote to memory of 5920	5628	cmd.exe	reg.exe
PID 5628 wrote to memory of 5920	5628	cmd.exe	reg.exe
PID 5628 wrote to memory of 5960	5628	cmd.exe	reg.exe
PID 5628 wrote to memory of 5960	5628	cmd.exe	reg.exe
PID 5628 wrote to memory of 5960	5628	cmd.exe	reg.exe
PID 440 wrote to memory of 4368	440	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe	cmd.exe
PID 440 wrote to memory of 4368	440	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe	cmd.exe
PID 440 wrote to memory of 4368	440	91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe	cmd.exe
PID 4368 wrote to memory of 5976	4368	cmd.exe	attrib.exe
PID 4368 wrote to memory of 5976	4368	cmd.exe	attrib.exe
PID 4368 wrote to memory of 5976	4368	cmd.exe	attrib.exe
PID 4368 wrote to memory of 5776	4368	cmd.exe	cacls.exe
PID 4368 wrote to memory of 5776	4368	cmd.exe	cacls.exe
PID 4368 wrote to memory of 5776	4368	cmd.exe	cacls.exe
PID 4368 wrote to memory of 2704	4368	cmd.exe	takeown.exe
PID 4368 wrote to memory of 2704	4368	cmd.exe	takeown.exe
PID 4368 wrote to memory of 2704	4368	cmd.exe	takeown.exe
PID 4368 wrote to memory of 5704	4368	cmd.exe	cmd.exe
PID 4368 wrote to memory of 5704	4368	cmd.exe	cmd.exe
PID 4368 wrote to memory of 5704	4368	cmd.exe	cmd.exe
PID 5704 wrote to memory of 5424	5704	cmd.exe	YYcYgdAC.exe
PID 5704 wrote to memory of 5424	5704	cmd.exe	YYcYgdAC.exe
PID 5704 wrote to memory of 5424	5704	cmd.exe	YYcYgdAC.exe
PID 5424 wrote to memory of 2704	5424	YYcYgdAC.exe	YYcYgdAC64.exe
PID 5424 wrote to memory of 2704	5424	YYcYgdAC.exe	YYcYgdAC64.exe
PID 5844 wrote to memory of 5276	5844	wscript.exe	cmd.exe
PID 5844 wrote to memory of 5276	5844	wscript.exe	cmd.exe
PID 5844 wrote to memory of 5276	5844	wscript.exe	cmd.exe
PID 5276 wrote to memory of 4948	5276	cmd.exe	schtasks.exe
PID 5276 wrote to memory of 4948	5276	cmd.exe	schtasks.exe
PID 5276 wrote to memory of 4948	5276	cmd.exe	schtasks.exe
PID 5844 wrote to memory of 5252	5844	wscript.exe	cmd.exe
PID 5844 wrote to memory of 5252	5844	wscript.exe	cmd.exe
PID 5844 wrote to memory of 5252	5844	wscript.exe	cmd.exe
PID 5252 wrote to memory of 5244	5252	cmd.exe	schtasks.exe
PID 5252 wrote to memory of 5244	5252	cmd.exe	schtasks.exe
PID 5252 wrote to memory of 5244	5252	cmd.exe	schtasks.exe
PID 4872 wrote to memory of 5916	4872	cmd.exe	vssadmin.exe
PID 4872 wrote to memory of 5916	4872	cmd.exe	vssadmin.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

5976 attrib.exe

pid	process
5976	attrib.exe

C:\Users\Admin\AppData\Local\Temp\FoxRansomware\91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe
"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe"
1⤵
- Matrix Ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:440

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53.exe" "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NW87G6Z4.exe"
2⤵
PID:2520

C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NW87G6Z4.exe
"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NW87G6Z4.exe" -n
2⤵
- Executes dropped EXE
PID:1544

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\h2LvQqlB.txt"
2⤵
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\BvEJRJgL.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:5628

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\BvEJRJgL.bmp" /f
3⤵
- Sets desktop wallpaper using registry
PID:5832

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
3⤵
PID:5920

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
3⤵
PID:5960

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\X9OSRutf.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:5644

C:\Windows\SysWOW64\wscript.exe
wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\X9OSRutf.vbs"
3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5844

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\NRkRVF8m.bat" /sc minute /mo 5 /RL HIGHEST /F
4⤵
- Suspicious use of WriteProcessMemory
PID:5276

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\NRkRVF8m.bat" /sc minute /mo 5 /RL HIGHEST /F
5⤵
- Creates scheduled task(s)
PID:4948

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
4⤵
- Suspicious use of WriteProcessMemory
PID:5252

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /I /tn DSHCA
5⤵
PID:5244

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\eDprqtTA.bat" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db""
2⤵
- Suspicious use of WriteProcessMemory
PID:4368

C:\Windows\SysWOW64\attrib.exe
attrib -R -A -S "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db"
3⤵
- Views/modifies file attributes
PID:5976

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db" /E /G Admin:F /C
3⤵
PID:5776

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db"
3⤵
- Modifies file permissions
PID:2704

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c YYcYgdAC.exe -accepteula "load_statistics.db" -nobanner
3⤵
- Suspicious use of WriteProcessMemory
PID:5704

C:\Users\Admin\AppData\Local\Temp\FoxRansomware\YYcYgdAC.exe
YYcYgdAC.exe -accepteula "load_statistics.db" -nobanner
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424

C:\Users\Admin\AppData\Local\Temp\YYcYgdAC64.exe
YYcYgdAC.exe -accepteula "load_statistics.db" -nobanner
5⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:5356

C:\Windows\SYSTEM32\cmd.exe
C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\NRkRVF8m.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4872

C:\Windows\system32\vssadmin.exe
vssadmin Delete Shadows /All /Quiet
2⤵
- Interacts with shadow copies
PID:5916

C:\Windows\System32\Wbem\WMIC.exe
wmic SHADOWCOPY DELETE
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:7068

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled No
2⤵
- Modifies boot configuration data using bcdedit
PID:4640

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
2⤵
- Modifies boot configuration data using bcdedit
PID:6004

C:\Windows\system32\schtasks.exe
SCHTASKS /Delete /TN DSHCA /F
2⤵
PID:6888

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4428

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Defacement

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini
Filesize
1KB

MD5
422f8eec63b6848ef0c6793c623ce318

SHA1
d7ebcdb9dc02c272022a05f696689b8d85c6257a

SHA256
a876414e72f12a1014cb88d230d85230f794d979f1b2657085c56b87044d6edd

SHA512
6bf2a7862e6713bd48002dc297e76091d5f9618ffe115d3906863e00ce5ceb6d20702d7003a0f0ac3951484d7a3229bb2355f33b2eacecc6d623743d378620c7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\#FOX_README#.rtf
Filesize
8KB

MD5
e396b7aca28a10c8e32e0c9d7d82ede6

SHA1
11ff9e5d5eaa8b410869cc78266072abb3124d55

SHA256
88a0802b7ee6cc9e6d9a5f32cc17885bda49d541b2993625507bcae79b8745ce

SHA512
2881302c89795d1a6b1990a5f398c216cfd6f9123ff6d13b3e2a3cae834ac9f5f44035cead1215417e464db71dcb2ad6b41cf009642bb08c877f325b36761485

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\bs.pak
Filesize
1.0MB

MD5
b11b4c1f4f5f7ff2039a7852882b9dce

SHA1
fc6ede9708a193ada7e344117afc3e931a5a8035

SHA256
c47be963b12d6607e344c1595647cee3ad993de24037e6e27a93d7e42ff26c2d

SHA512
a4aa1202a756163f0934a013ffa603f67c26ab084d1ad021676bdce16c3fd9c646ed97586568182aab1f9e69e8541f9491333236ecec9fa05137d565fe9df602

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\ca-Es-VALENCIA.pak
Filesize
1.1MB

MD5
9336f9851b8c0c420c8fb742fe1f2718

SHA1
c7a5a707b9e8cd090bf4f719a165ad05ce88e013

SHA256
6d7749962c67e5ef2115105def2c838b78b00f0d3c3ead08beebef90378b79c0

SHA512
d098d58762abb75c21573ed847c2da81fd84abd663da385d634fcaf48cb3587667e1669d8ce554b47ab1e04473cf120bde662d948b860a3bd8b28b88fada3ab6

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\es-419.pak
Filesize
1.1MB

MD5
8ddbae2694f6414ee1155f7ba3e98535

SHA1
a40c3772652b6799845f3f9f95b5f801abc3b89a

SHA256
2dd5c886a4c9d82766175da4c04a392ea414486c76c6cd8004f6bdaeb41f20db

SHA512
b221c1e5e4c974ec9bcb423aad14badd817fb4f03362b9f40fb37d767838470cf4c86a2f1f18beeb12d38d373d6045cb7a6dcf778fcc0d23eedc2a783b9fadb6

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\es.pak
Filesize
1.1MB

MD5
82430d35080fa66c2daf7669d8d0a8b6

SHA1
6ca7193354b1188c2346f1fe1b313e030f1e5f72

SHA256
9b852dd73fc0f2d140b991244f57aa08f86503dcd8f02af74fc0ca768422ac5c

SHA512
88baed1452ad18fcb1e93b738ad78121e3e4b3baa9af31362e9aadc6ecb169a0ce3fd8e1838104e170ee93d8853108df4641bf0d0fb755379d0fffa7a4f32b33

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Notifications\SoftLandingAssetLight.gif
Filesize
126KB

MD5
f3cd5ce4d009f1589b9ef83f5ef05370

SHA1
b93d70f2f2a7c50d55b1d106bc54a10aec5ae405

SHA256
d41ec5d110abee9031e0ec42444af3cc3442ef95340bbcf13e45036d72eadcdd

SHA512
b0c85e75d5bac97e814a14b9b902942a8537b432f1a025c89449c785353e576894de44db121896c32b0015ac952ec4ff2beeb1486f9056feee14bce8063484e6

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Mu\[PabFox@protonmail.com ].14W8JFht-GMnXQSCo.FOX
Filesize
69KB

MD5
46c41422c7c2d5a9416c741fa66d945e

SHA1
b71bd07b667135331b534b241be5bc7625ad13d8

SHA256
1d57956d8e5568a927b17f026ea4f4c997898b0f30d2e0f34c1846dd4b180478

SHA512
63e2dac0f5c6ff278dc340b65c760798939db79e809d64683834c21a4f03b2142ec50937c7cd9e5e208862634578e1e5857abba3cf2c057964679e45db4b047a

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Sigma\[PabFox@protonmail.com ].JMsNR1fJ-0OnaCNy0.FOX
Filesize
18KB

MD5
76793c71de41019e3957a688afb350df

SHA1
945044e0648aed270dcd5d7e0f3a08ae4af08bfa

SHA256
54105f7bd9e52e63f82ed0c3736eb8fda1cfdfb2713fc2cae766f5634ae355e2

SHA512
53b2db021f9b2e9ce082d2273762383047ff20468e4f86180ec671d17579b6117a20d7dbed7cfb316a036640b9b08cacdf53945857e7f75ed56aed472665a003

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Sigma\[PabFox@protonmail.com ].lIvtueP6-Mduc5Zyb.FOX
Filesize
1KB

MD5
4d7cf6b3bae181fff8987ba9828edbdd

SHA1
dc5c44db93ba57997b5b55e6210349160383c916

SHA256
ae7edea3f60aa3b35c9298765cc04c52446910a7f0536f7936580c03febe5d03

SHA512
d8b832a0f5cf362d7322125401c1eb64c6a00db423ca78573ab6e97fac656f51417935633a336afbaf59df990673aac85eafdb3d0f9be0b209639bcd165d8557

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\[PabFox@protonmail.com ].846lUNq0-kGpE2kof.FOX
Filesize
192KB

MD5
a7e7881ed42f92bb719ceefc77b60f1a

SHA1
5cb32ad0e453faed36940426227cd63bf060cadd

SHA256
47a5b9d754b4a0cd8e8e551c5624654872a56bd27f02e5ae736d6a7362b17e52

SHA512
afd62824092d00eb5995d52b7d08a47f549db8d041906e8bfe66ea25d0702c5e9df30b668e7600b712f37a60684c01e202c7ffebf09b46d16224f2d6945c3678

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\[PabFox@protonmail.com ].W0UFhDAj-YbO9bqTY.FOX
Filesize
448KB

MD5
77893bf2f9ece54277d48aa119671a47

SHA1
8958527a8ce55bcaf44e6b7b25b0a87ab2e47f29

SHA256
60b4799b3d68abe8a4ad89639d53f3743dfc44f3f22b758d8645ff918a34c8cc

SHA512
fe5a048bceea24c5fded727dd94b41c45969f96fd006c3e5d0080274ab4b78a4f6b802af0b12a7fd91366504a5b9e59d649f30990c9906d76084dbaac7662c4f

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\[PabFox@protonmail.com ].egVTnk6V-PGkBgwPZ.FOX
Filesize
512KB

MD5
14773add7dd2af3649a9eca735eb9d8d

SHA1
4cc373e2ab5d6b7d312b499b8ade61110d6e72c7

SHA256
60c76da4341666d58f1752346cd2fa207c29f5544e5f239839990bf5203f3e14

SHA512
079ed2a9504ac40ab918e311f418e29e838081195d9a3c762ffd17c6cea2b89b33c3fd9a38daaa6cb126b5aa9ebf989b0eb26b82124d0ad5d006bf3780d1c22e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\[PabFox@protonmail.com ].fQ9xQwwh-S5kV8Ynu.FOX
Filesize
14KB

MD5
91df8a553e2588de2fbef82dfdf45fed

SHA1
7582cb53a89a81c34a932276e3bc08d94e97bd22

SHA256
66b3f178e49da8f146a9a00f362e6adda92525ed340a6306f66467c1904b479f

SHA512
6d31bf00ee7d35f886dcd032e0e69efc5d2a9e871a7b9b0a57ebd5d640163d006a677284be47510830ac67db0029a5a27a0ebe844c4ac0dcc0b02cb4ec381cbd

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\[PabFox@protonmail.com ].mPIO34HV-w7dEKQqb.FOX
Filesize
192KB

MD5
7ff6e258af6d0a21a8b24e05c69aace3

SHA1
4af6cbbd41e21e8a336e4cbac52647bca1b203aa

SHA256
dd73a49d724985c6e4f2993b66b22c03732b64299dc2883bfc9d9545ad6279ae

SHA512
c0db9037f30660702c85096e9c8c8eafc7543d991d931e6f0e830e8d48976e10e72227f66a9b9a5d5109f218ef7293830cab0a33c7b60e8e39cbc9b284a03ceb

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\[PabFox@protonmail.com ].sd3HYvbB-SbhBMo8q.FOX
Filesize
448KB

MD5
2fff13976186a1b2281bf3f9f2b20ed1

SHA1
83757b7e81a84e8b6ade1ecb060e64533a77df75

SHA256
a6175c2fe860e6fc79e40085971266dac9f1a5056d3bc11ec6dbf6729b4e1f5b

SHA512
89c15f7abc23977952b10c55e824440077d08b40a67c4e89039c33e2b2b9f2e631b28c1c2b32303329ac13ca88208711ffb709b793dd40bca7303fe4f5708a2d

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\[PabFox@protonmail.com ].wTUke3uS-NRkcrXx2.FOX
Filesize
17KB

MD5
a25f144b5b58a43e9c84aa0302c51b09

SHA1
1107053389676645b3993b200d4245bfb6b01f1a

SHA256
57930520d758eb0531e9155d3f95511cc1cd2b300773ab5a9d2d6556bf35f089

SHA512
cd37e4eae59cbddb2f82807f42b468adec0838350998ba3ec3232680dd0a90f652d4b3167902b4167bfc0cdfa912841631f95f5b9a8c2024abc1077f7b815dce

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\[PabFox@protonmail.com ].xuZhI8ck-TETLgwLA.FOX
Filesize
1KB

MD5
1040cae56291249ac92c3c9a140fe628

SHA1
b2b99929ce94826c7c876d7ac3a12db1766a6d20

SHA256
6e0c9ee253b4cab1315b1bdce1c4dee4be7c4cdb341e17b971f7b0c7cb1f4088

SHA512
ae8b63de76f877c5fba841572608ece33ae58cfac01eb79b7f381c8eac694f3a0aee6aba8bdeb321aaf81c99c14d41475d77f30a0d3c4fabfde7355862420d39

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\icudtl.dat
Filesize
2.0MB

MD5
f402120dec5b59457e42905668341ef0

SHA1
a5bd8abf9567574f140fb19c2fcc5fd8cdee3018

SHA256
e70374b68b2686ab66f3d63605698e194db2868cb2aa2998e480127fea6b4a29

SHA512
441210487d1c81816b7f7c99e2adb10ae5e63b12f5a66ad653f6379a7fb1a792643f879bfe17a6153d44733c5826185bd11ebb05c3be9beceb854c537eb3cdc2

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\[PabFox@protonmail.com ].xP2z7Eis-IqYYvyGj.FOX
Filesize
2KB

MD5
72a127abd66c26fa63164ff47533f01a

SHA1
948f1da846e08519c72510e8623d3bd2724685b2

SHA256
bb1aac4270909501fd73bdec261c32e71afa8f27302a2122c0370998ad48faf8

SHA512
a335e8f48dac4619a78594d9559f3beccc8a04393008a33e543c2c9b6c43170124df8afba07d8f1c6e48b39b066702c59d7ceadf7cf10a82f11ee113c4d834bb

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win10\identity_helper.Sparse.Canary.msix
Filesize
54KB

MD5
cfd5e0ee3982788ba38e5d69e3be03b7

SHA1
4d67d91115054525cf6b36dc713cb3c83e035565

SHA256
aaf9b0293211152534ae8d66413e096ab3dc731055aad467a59642765bbef524

SHA512
3ffba7a71c715dcf0863d918a5ea6aaf38a44405cabb215d85fb190fa024441ceaf686bb3e22edd996c7345314ef089384254970d2fc974d209e7d53e72a7daa

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Installer\[PabFox@protonmail.com ].dODe2Efu-Hjt2DMP2.FOX
Filesize
4KB

MD5
b5f3e0218a923e76a8e1b8b45cb672ec

SHA1
493ccf7a4b7c175c0e78d606a80c6e4850ada97f

SHA256
5ef8974f266b18bc67d63f5833303aa90d74f55b1006f4815742d90742c98eff

SHA512
e547f962e910e96d31193d5e4972369a08383a440aa10d55d0f8f669123cadbf80d62b84427245afc4b579bb4ea748c7d829564bef47816b96a9e62f0ea4c6a5

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\af.pak
Filesize
192KB

MD5
aa928c91e472344d96019b47b85214b1

SHA1
9bccbcaf1795c31bb1f83952508e68ba9c7994c4

SHA256
0d429dda82dd2a6418b6711aa0987b85adf56b5ea1da8ac65315b7b9e0d97b69

SHA512
e8b4cab0a1bf7dfbc9b3a1b9e0d70e7b8117e77bd828934f0c2cf6ca7148c5dc5492a9b9b7118b84ee79a249b5255382f802315f982f2d70ac2d862f195e773e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\ar.pak
Filesize
1024KB

MD5
502e03ce48d28acf399a7d8a8757405a

SHA1
27a6e0764c5ef8cb9615eace4180d530b667d433

SHA256
d2fefd05e983f83c8db28733234eb4fe1e1605c5f1a51c968e327f955c46bd4e

SHA512
97d3669515469e5d61b680542af8b5b7973dcdd38c0fbe537b29d2eb39341b32376fea4c6c455151aa936bbf4bc9de3a608dad9e84f6422920963d987bf27843

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\ca.pak
Filesize
768KB

MD5
1f99b3257f8cd313ea5e4edaf1f97e4a

SHA1
4cfe30bde61b7546d8327f1b91d098af3d05c717

SHA256
61707e89af1b8f1d7567694b5d16390c571cf209984cacc9ef00ca200ab7dd0d

SHA512
16870c70ee27230caa02ac4c308973006e369d878552dfad3a5f1c76e9a4a04b94f701529082a759dc3a056730cbfd718e45de38e1dbe81074b53efb73d168c8

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\da.pak
Filesize
992KB

MD5
9783647f8807fb85bc298988d8cb8c8f

SHA1
e7c13d0e0057eb6c9cd20ef99ad08b7d6bafc739

SHA256
0a744b22b34de28a42ff8f93c32595b6130c040dc17a940a642749e3eb945c8b

SHA512
152b9674b7668c4f63e7ca21c88e16cd365a1e748d195970ccd5c11a3cbb00698e63be45b728856854013b6cdd70b5e75d3549d10965ce8afad9aaeb110dd4e4

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\et.pak
Filesize
768KB

MD5
13c4c7a87ab9c3ad81e437ebcc34639d

SHA1
b8d0225623e238da7228a3a05f7cf2b2222f2052

SHA256
a618a6c6d158535390310625a7a81c61818ab4bd13fe454b965f53fcb2edd326

SHA512
ebbd0b3c2bb9fbabf3764b24f964a11fe89f6833023128b41fe9ef6627f21c6a3e6fa47e7f0b8bb4ff72bdac1c1eeab199376ec2951a2a0d183ae8b933a24005

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\fi.pak
Filesize
1.0MB

MD5
a1e021a282fe9f7d474e3459925ee47e

SHA1
26c59a5435af1a159a56a5f593eeb7db3972f8cd

SHA256
470864a8b9796da05e1e70af316c60025cec079decf4b2c4082dd67fe8ff7f04

SHA512
71ac7d1836f4ce6558db14c412f60f580569d0ae56771ecc6b9d20b97320713297677d2626d816fe1d8d5f83e2794f05be59fee0677fd0ef9bb8bb0a5ce0be92

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\fr-CA.pak
Filesize
1.2MB

MD5
810835ef8c181fa88bc49c0f0d0f6f1a

SHA1
b00258102378c416f101c2a8b835d1250ab6103a

SHA256
5c0b3ecb805959c002431d52b7c790a231ba2a69fa2e934e392a55f6ddbade2c

SHA512
f701713748632c7d0eb06f95a856ebf285e44a121bebf6b29422f737efe33d5f144bcd87dee14f49185913c889342acf2e8a4b28d4672e4ed1b4b04c610d5831

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\gu.pak
Filesize
832KB

MD5
203209fd9e23f16da119fdac092b250c

SHA1
7539dcc310f288cafd85554d0e2ee78569a3f611

SHA256
9f142070d148c06b79fe2c849097ebf66d8654c159bb81de77b2974d21273411

SHA512
6b6071040a4e633dc23f55a8de3b343f7d976da53f1efe712f658b5b4beec736280f15b9ce8188c248df1fc3406f43c5a5fd4fcd198e2a01452f0b18ca3fe496

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\hr.pak
Filesize
1024KB

MD5
703f8a29e47479a4ee7f0911b2ef08aa

SHA1
3d2d7d54bfaaff11b89d15b2c514a1e118fcc909

SHA256
08b32310b4c338a6fe8ebcdcf6abd178d81fe245bdf077e89399d05499f6f3c5

SHA512
fb66820f919aa5d71d39aebffd45ddfb7ba3f8e281edc209ef6dc4483410c42e93b7bc405f5cef726e87d08a6270e4137e2bc5ccfd8a2c24033751990fd9d71c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\id.pak
Filesize
977KB

MD5
30e90764a00068ae04d10054b43c1364

SHA1
50855bc2b3683fd7a71a490d9990e94a3c4278c5

SHA256
457411b8f677f69062d3da471f0a6016c35a4c4cb7f553aa2fe5a22171e8b56e

SHA512
666681a28b23e86c57be77b9259b2bb3c828c614327403df7472df2fad00a7700d45de594c2a7dd6287ce7e85d8641b97e06bad8e2c0b869595902c541a44f79

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\ka.pak
Filesize
1.1MB

MD5
08d8682f2ab8c88422f16816e02e28db

SHA1
5849f978a37e04dc87d8ec20786b34a232d5c567

SHA256
0d9dd23124d83a3b5dce65487a7461dfe5a12504f897a39045e1c98a5e0171d6

SHA512
b1c300d79d9c7157998fcd4f73f7cd4c168d8af331aa7443b5138566cf90671a9b7bcee8d80fc712babb93f9ab22a6c13431134a4de210c410334ecadedcc2e9

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\kk.pak
Filesize
768KB

MD5
4ed472d5cfd28a1ee97f205b5b1e29f2

SHA1
ccf45faff1e32420be2042aeef912866899a8669

SHA256
17e6a376259bf3eb6cc5e4e4c9c1d95c18140b6741b55a4592a0ba41b5d020ad

SHA512
040f936242ffb7be5ce69ec00f7004cc165eb66f53cefee16ed7ab83e80d711e8d2703aed0d08a2f7db7a1460fe5952142ff5186b2f34bf209de7ffe1751c156

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\km.pak
Filesize
320KB

MD5
b413a7c782146509be1727155016c811

SHA1
291660e0325fc881018d0796179da120aa838c88

SHA256
10c5f4c9f526639bf85248332a56a4f476a1711f722b941004ae7de62ebcb3b2

SHA512
6d19c57137eb88c94ad0f9178b6c452bf7438532b3f589a2aab8946bdbe045bebc38a1f9afb9b328e721c1110973bd8e9909e50576e487716a41ad711fbe9d36

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\ko.pak
Filesize
1.0MB

MD5
78f2cbac9e9419271fa550b44e664a9a

SHA1
aab71ca1fee1405b0222acacee6a742a02b090eb

SHA256
446a4a43f9a58aced1c2ef8e952a5ec82a656acc34295b741573b1fcdba195cd

SHA512
4b7ca66314995c6a885b86458a58b4280a49cc4c4fa9acdcee1648dedd8613d0dfc689e7b54833f5ba0aa9ff6ac48554cdf520e507a138851431b0df0faa504e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\lb.pak
Filesize
1.0MB

MD5
c5b3c6f9f1faba83733d436ffce195b2

SHA1
f74c53ca74ed397bc06382ea50990671f6efbac1

SHA256
d06674e956ae62dc2fae2ff49445add99f13890a7a931865763b8821732c0f7d

SHA512
07a0add67c01d89b0c568b4ef9552a375984ac0ab3ab1fea48643724f1b72552cdf0e36decd9d2d010a47ed4f962a265f44b9c0418eaf023d5db60d3db98f8f3

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\mi.pak
Filesize
1.0MB

MD5
5635f3214fa53e799ab2069c6111461a

SHA1
0771f3cfa45c688aee975e190a64a159c3310dc8

SHA256
e08fdd51781450a1e8caae18077e6b78a2359c7fe1a6ab941e6d0c0d6ffd4126

SHA512
d24ae71f0710bd1185e5bc4436970ea4c659253a72beaa89e4c22094f5c79488cb9f8377b43babc9f7d701ff05478df998d25eda94ae7a84b976b7b05d7acc64

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\mk.pak
Filesize
896KB

MD5
1c15ead197be704ecb31d0cc6732cba4

SHA1
63a27eb511ffe9c07a9758ae90d5a3457a43be43

SHA256
d764b04f8b8da657fd3aced83862ccbdaa5ff73747b604142efbee6d44ee960e

SHA512
b528bdc11b79b2ea7623ff2074844ff8edcd100d9a85a349e2012c0aaa23920e9f0552a5c5dbffd13a7bfb26aeb53b3a2a1a1644f8257d1cb14b228d139656d2

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\ms.pak
Filesize
1006KB

MD5
cfddda33cfdffe0bac7b1bc869658c9b

SHA1
e3565921c7d1a35a9e392af33403511373f9b5be

SHA256
cfabad7a1a5efab9016aee9c1951fe5aeb7b0491873b3a54af8cb305708f9e14

SHA512
e57a1302c29b9fbe56fec4aef2d93b2818e1ae27940de7d60bad53c7d970bf1713054ccdcc173693de5ad852eff74b162825ede905c195056fa643aed131466b

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\nb.pak
Filesize
968KB

MD5
84c1f64e1765d65883c1bf7fe68b7559

SHA1
76c2313aa796cdea5b8a1f6347ddcbc0dd5d829f

SHA256
c1c718e2bd37b094402b3e1632cf71eaa7caa0513693bb4d113de6a05cce4ee3

SHA512
e75f83f6a741e97274adf57a5d150e55c5f1ca6f46c7d2b27c28731c91de24caa9271c84b9dc0bf3f08831446e0f99bc632e23e171490a1c0a7b35daa6705558

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\or.pak
Filesize
1.2MB

MD5
ecb0a6468e074acaaab1775b2411c77f

SHA1
57c72cb6067f3232a337214906f562367718af9b

SHA256
d1aeeb00e305b926453fc452fa3cb4b24a2d334d58c07d39760da05f8d4e9aed

SHA512
19f1959876adc59407da2bd6837ea3c42df6822da1ed89c411d5b5d92f04455c10418a7b6b77be081a22ba1a11b5bde24689289cd2fffb043d1dcc4c963f58be

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\pa.pak
Filesize
1.4MB

MD5
664cc72baac4327dd80d066b3e609f51

SHA1
965cf933682737881c8f6d0cd033c2ea0ec70126

SHA256
b940b5f799711574a518a7cfdfb582018a34565ae7b6051b1184cbbacd1f5582

SHA512
333cb6df441950c5b1ffdb0589dfc7680443b97815d2eb8eb63e890a91c8b58d6184aec4359cbac9d1739ccf2c68d8155dd6246a0efc9bea47c7e477c394121a

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\pt-PT.pak
Filesize
1024KB

MD5
4ae1ae1cb106556d764c72deea56cfe7

SHA1
e8e0c8e8ad8b21d99da57e5d0c9f64e12ea4e7ea

SHA256
99339f819026a990f3b7c0d08c14e3dc73a4b021ddf8e62ca6ce6dc62e4a82d0

SHA512
1ba1cca24b380b5ad55e9e898a87ceca8e8077818d2dd73c0a5bac8f40c4e8ee2784a0e205a07132d3657f0e6a530d2c2da46aabfd89d18e3f6d1bca761f8b41

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\ro.pak
Filesize
1.1MB

MD5
57661cca02c7b882614e9fca23b596d6

SHA1
602e7e522dada863b788c009a9a3f7f766c8b2b5

SHA256
896c3ad402bb2f89b944bc6474ebc7fb810a3ead98f1e7f01bbd69d6bed64419

SHA512
99b1d00826c3dde15a4e23ee5f656e00191d4eaa01b4515803345e68e4681f6495cf04696b37a9754664b59708885c6ce9b18fb7a7f53687296494aa4cbb78d6

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\sq.pak
Filesize
1.1MB

MD5
dfcd88d798db4cccd653d7567638e8ed

SHA1
be416f210046b13f13399dabde67ef68ca9096a8

SHA256
56d097b3c752cd2d27effe99adbecffae68aac4d3cd6f43b2aeb5b49f74d4366

SHA512
8b696786f72c93ef276d170abaf4ead16c3f020759baf94a33e6b601e54b08de9f3de593ec109a80756ecadbfada4cdc317ff1dad874a52f2b684ea3c9e538c6

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\sr-Cyrl-BA.pak
Filesize
832KB

MD5
950ad7506f1c8c05b387ba4ea68662b1

SHA1
2ae11cf1cf25196bd43c2e30315e73aee57bb867

SHA256
46d5db6be13033c218009d1a88821743aa8e066a4b04abc3b94cb2eefb179535

SHA512
001c07e1f9812c97ece2809e27696b4c1fafbcd2bdd8481afea9c247d9ea039e54a4c1906ae36ee6c625a318c113953d7948a1ce236146cba472ac11953c7ada

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\sv.pak
Filesize
993KB

MD5
3a61b2d490f1a310403297777af21b8f

SHA1
f9023229efad370050ce56a72d8683027ac21927

SHA256
c9f6d9464ef3c128137ff8d5c3b85cd1bbf85b749bb4ec4d33d9d5aad6cc3997

SHA512
f7f86e54fbeaefd2def106792f8d4329f0a2d03a3d1b933164717cdfb9e70ecaf6afd46f15fb22ea96e091d3221a456dff3e470817124697f17fc0e3caeb0271

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\te.pak
Filesize
1.4MB

MD5
29750d794287c8ef478f4859e69c1ec5

SHA1
87b1a0a08e64764f9492a97173a2a2279aac156d

SHA256
d9ebff79150bc9ee35724ad20409c4c4b3d01dcb41d9ef91ba0c37f1331e3eae

SHA512
dba44ae846cf9b485e602c5b5f27145ea0f3b7ddb166f409235083cea586f30a61f237363df23bd85ef1cfb8cccea42405ab134bb63facb72d665b6384e21a11

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\ug.pak
Filesize
1.2MB

MD5
c3bfa9b6e0cc0c26e4008f051d7b5a52

SHA1
1793f41dbe5b8e4baeafadfe1e207d9c99e98204

SHA256
1367d1d2e686848aab666edbdb895d8b24c16330b18006eabdee90bf8bedce7b

SHA512
9221b81f894dcb87c764cc6dbffd1a0234d708dcd749661cd8e1a5107a5e767ceade276e19795053d8daafb636d6392b40f70176c6dc45d3abb9cf07253b27bb

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\ur.pak
Filesize
192KB

MD5
3d0793687987ea7384f8e8349a32d954

SHA1
72d66ef511724123534f2153f4d4d35659bb5b88

SHA256
d9032f2e9207d87270d17712b53446a5d651f60384769169035444fcd5902ca5

SHA512
07a514af7f4fad9bd9e16c3698ae0e34401828f0b718d045b5ca8f483a6432d719328190396565793fa6fa8a7bbc4b68eabddc7f7f92eacb42747f70c85d1f4a

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\MEIPreload\manifest.json
Filesize
1KB

MD5
b60c7d04892658a6d41c474db94863ca

SHA1
ba29ff81c81a55f39545e08f46a05a467de9c3bf

SHA256
b8e702418c3f4bd30f314037e61b587acc82d15ac2ec8ac05ba29420b0849f59

SHA512
c1668473338a12de5c94764ad5e4306afef246ec589ccd9ebdca66939716f18b1700eb5321e46b0324ad581759332aa516b6181993baa1f4ad41aea6d732e53c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Edge.dat.DATA
Filesize
13KB

MD5
3a24fc5171e67954d1ae1e167ec2f3df

SHA1
e594092f4470d64a0b40136a9e2940973427fb27

SHA256
8de7c226398cfa8c97136b0ac65c73cf8285438adff5152cf62136086765826d

SHA512
0e4f81ae694b46b5010630cf3c7b7e0124eb8afaa414efc628186b89666c0f92c90be564a73f6128bc07945b4da8fac6acf748373e965535da142f6ebc33fee1

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\am.pak.DATA
Filesize
1.4MB

MD5
c9debc1901a7c9768480825f790134ca

SHA1
e59b10378a5c5f08020b500fe1a20efebd4b02eb

SHA256
00742f7686ed1557d767e45bb0c3a7b81c5c2a7c3c5bbacf89e54823b6f9e9df

SHA512
c4268cb2bf2db769597dd97af0b6571801da7f250d2ac4aa4d1b7129acecaee2490930dd883fdd02886818eb9c9bebf591f87c88fc370dd42878270ed0ed3176

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\as.pak.DATA
Filesize
1.1MB

MD5
c30c6f6027773204da7a8e809a21b07d

SHA1
202b38d4dee62a30e4c93b42f7aaef22f1cae20d

SHA256
c8f01be520bec5602aecc36e8dd82e19a151ab8a95ad1f9ba9d77014c8f9546c

SHA512
9ee319e14befd3d49cc7fa3e8e22db1fe782039e1eca8abc9fab6d282710fe9d552cfc53e2d2d9c449938769967b2f9768291cf6ab017d086735df3f244ae3fb

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\az.pak.DATA
Filesize
1.1MB

MD5
76d7f13e6f241538cb5ace66ba25ce28

SHA1
5d5ee07a4e88a7fbd19393b99602504bed6804c1

SHA256
b030dc630611738af146f9f99e916a5ad8697a2327dd89bc71574e1ef9e0d4d7

SHA512
a2b480db22fdc7cfce03358ce4c1c443c29b286587369eab8de05d23fc8634f1cc734aa985cfbbc03d6dc93a613baa95c72345e792d8629a0faa68f5802f1871

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\bg.pak.DATA
Filesize
1.2MB

MD5
89f8ecaeec458fcf95d1ebac7bbf545e

SHA1
395355cc5eeddfbb079b430ae15afe1c0e32a335

SHA256
51b5d8c55e5c19797349f9befa5cf6193d51f4b6a49e6bb61b6f48c6deb8ae1d

SHA512
a77f6d45ad05b1e3a8337f6d51bd6379d2e612d179662502f83fcbadc6aaa7915db4dfce71e386d57771357afdea25e190063d5fe47e3ead256362ad629dabb5

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\bn-IN.pak.DATA
Filesize
1024KB

MD5
f45a6e8f46a445597ea35935607bc1dc

SHA1
2e06daafe461cf8816439cf802115b1f803f77f8

SHA256
bf5aaeaba8d5191a2fc0bcd12c52f4552cb1a7af3ca345a7fc9d29c083da250d

SHA512
a34ab7954636e70791ee6852c8f5cd3ab7eac3b2fe06bc1495250b2089877a29eee0a60e825712b4173bc4144fc998ef264f97622afecbac4c99faae9c51441f

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\cy.pak.DATA
Filesize
1.1MB

MD5
d9561e1d0682c85ccaee970a03365670

SHA1
d8d4cd5f372ca7dc137324ab5e67c200486c3b95

SHA256
bec657a410745ca59ac39867cc78ffa5a73ab16f189a1e705d009346dfb1c481

SHA512
bf8def84c8dd93985f2f1aa6e1c6f035d5b9b25bae21f6aa356079baca64ec7672f36f5ed38c34eb38eeda9ffd45e1d3c49f923a9478fc6c85db19617cb62c77

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\de.pak.DATA
Filesize
1.1MB

MD5
f43ab52c362e2e825ad829dfcef84c38

SHA1
1cd2a5ca63241a9a47e05c2116977724e60c7284

SHA256
aa767826a6e99ffc990d4a5d6ede11629987be02d42eddd27953fab374c25919

SHA512
f3098104608637faf21f071c81545beb283bb00915ef235fcffaf3c87ce7b82854f496c66053a1afcdd68ff760a80c99ce5b77d57535d1dac074305204aa2729

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\en-GB.pak.DATA
Filesize
768KB

MD5
8187a73c28ea03b863e82d6b339ce67b

SHA1
074a8cd3c15b6d9be3d4d419fd3eddbe79dfe6cb

SHA256
070105be7973ff0ec781367bc116c39d44e54d5f9619ff025053a969022a4463

SHA512
c3bd2cf626262dc6b2336ac96044fdbd044a91eff599b332716b8659e725a394e46261a9ddf52f288237ccecac039733be18db3dd59783aed26329b37e62b90e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\fa.pak.DATA
Filesize
1.2MB

MD5
26201d9e560cc2093b3f99baa2411f23

SHA1
1ac71407bd92766628213dbf325d441d9b4d8722

SHA256
c25af9897cda15559de48583fbe79cb72ecb60acb0cd82c30c4bad77bff3e5f3

SHA512
6501ab88b11c97468238f19a8941a9e57e41fe444fbf2fffeeb4134bcd8db647757c73e6fe575ae495cda8dd06d9e7a08b2e0496e200d6fcc71d4321b874bd0e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\fil.pak.DATA
Filesize
1.1MB

MD5
bd8a774036cc53d4a1541abf86dd641a

SHA1
62c8693de057c6c9a3f90998857bea4d9583faf5

SHA256
0c0106d884f06f11b7de69bca08eb559b5f66b8f146c571d0aa7ea9a948fa2db

SHA512
217512643d099bfb6464dd9bc41e28b5ae61ec92211d0aba30f1f5335fbd1c59a5d29efd03c6b927b58d3d2a62e5dc8ab6d49bde113fe5c5a1d4b466e802f11d

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\fr.pak.DATA
Filesize
768KB

MD5
db27249dbad5a8deedd89226570dfe6e

SHA1
bac3a88b88cab0fd8149ea5b4e79e56606348afc

SHA256
039ee4765bc0e8bce480e7c730b3f1952ee7c887c60caa6afbeb3fee8d7bcfad

SHA512
9457bcebf964578156f3964eef6ec05cfed8721e955822459fddf8760ec5eee6e86c0cb118465ec376002e6215bedd28ed8fd915fbf09f4ae910b1cb0d544d1a

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\ga.pak.DATA
Filesize
768KB

MD5
c8d7d67138f44de9141c1f00889821cf

SHA1
2dae523eeec6d885f9b6312af7de7938d2884836

SHA256
85e4c31251693b10700491a8631c9cbf2a58429c8e5de21d2394a253301477bf

SHA512
c1aba4dfc577d1fd285e49364be1de5235900982945650072c218563d3b18fbce088e3e67652f392802cbf8f7843f27fb04733cae96d563a2781aadcfe7dece5

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\hi.pak.DATA
Filesize
1.4MB

MD5
7f518e241e09cb0a2274b7d61af1fa8b

SHA1
80e596d618d7de3d9f086fea34260d3dd4b7530f

SHA256
adb83a3b31864c0336b458e533066e158e6b7bfcfa1ce0e095b25a13a3101221

SHA512
1b7bda8780a8ef6ab157e78e1d6497dbf981d672eada278d6ffc8166635f474bec5d97ac078d685ad9ad664cad3e896e2219489663a9c5bd7bf3dc1ab0af894c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\hu.pak.DATA
Filesize
1.1MB

MD5
2f9a4cad25d0124dddb9e80215ae04d4

SHA1
732e06db7dea7c963a5f9613943d951c9558acad

SHA256
ca242c31c2bdb82427277715d72fa7fbc596432835c1e1fdc3c3a4a8090fe4d2

SHA512
d75375cd716f8dce9979140fdfd1d2bbb713a27895c0a1dabc6f4e718c8a6108563d129087d2d5da81503a8103b0913f58c86e1a815c3cf5e9309a5ff05dc584

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\is.pak.DATA
Filesize
704KB

MD5
e2d10d96f7c42c95f594aa322a22f35d

SHA1
4430e6a16ba23816663224275d4f44db2660b9eb

SHA256
f3dde2243828276db99d66b2df16041c4c8529bb36918e5daa81fbc1f9205ccb

SHA512
86d2177b6b34c582ddce2733487cf2592d78b6dc17850cef90af096775d87cfc7bc4926062ebe04a2432568a4361117476b9ff1896a4e623a6ae65047037e991

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\it.pak.DATA
Filesize
768KB

MD5
e6567f3033195711ab1acd052acb82f9

SHA1
462bd005b07fb44a651b064bdc66d5f7c679084f

SHA256
24ec27aa5120231ab5cb8da2444f218250364233a3894db9c8645a06b7dbd3f7

SHA512
8adebeb1cb6e7be5cc4ee30ae0f85b9773cfeb969c4cabd49ae693d987e5f8b6652ac97c7d5339b9c2b0f80dff12951a39ca3ad2fe50edfc05445f9c5c00c286

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\kn.pak.DATA
Filesize
1.4MB

MD5
455530dba4ab3965758411ae6d6ce1fe

SHA1
af26b40ecdb450f21d869a1e0f4774c69851dc34

SHA256
abbdde0c836a55d8df5aa6a60eea662688f92280b0d2aa8e757c1bc380c9e30b

SHA512
02103c4b610bc88c6cdedc929677764927108f494a115e792848011ec1d72db50ae9875b6ebba576b6e3567a507ea5b0fdf03ce074870c20dbb7d3e641443a33

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\kok.pak.DATA
Filesize
1.1MB

MD5
e6716d2b2ae301755566cf249d36674c

SHA1
be4c631e1ba3fa6a20dd29e8ca418240b9d0d24b

SHA256
5d66b65b16442be2384be12ac02c7eea2eac8be678760533fabb0be9b15ae51a

SHA512
b27bc1d009f50d882d0c9eb6451685cdedaa9901b96aa7d8ca3ece9f48ca453dba6fc27222d2a1c59f4848beb677c799551ea5d56152f5b10ec6d2499c3c4e22

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\lo.pak.DATA
Filesize
896KB

MD5
dfff730eda3366c750cfa61cdf07e4cb

SHA1
b9f7e3aa5c5a2080714aa4516741d334964063d3

SHA256
337f21c97ce9d332640d577791244b91c1e4fcbf10939f97adfcdf4208ece6ab

SHA512
72bc2a2f58f090eddf6c133590d4487ca7758959bb2f609d7c10a685424245f6192340f5f1b411c5bfae28a9c1dea28a87f64edc37444a7356fa27c7be2c193d

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\lt.pak.DATA
Filesize
704KB

MD5
096a0f677be061925fd88317ab216aff

SHA1
7ebbbb700dc72249c8fc5eda48134c2a34ac0d3f

SHA256
1993ad7bcd2d25a759480c8aeb3056ae5a4c1dd21632a11dfd16920ea19f1840

SHA512
f93ccbe6b0f677873d04c93cc0f23017823bb7a07d1aad88b018e987ec1e82dfbdd65e3a2e900b3cb1256fad6b1437453ad565430ae7ca7cf54db4dca2362760

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\mr.pak.DATA
Filesize
1.4MB

MD5
497c5fb5734306b349b5919bb0f4f9b6

SHA1
b584f2cd69555c93a5e00c809e1675691d3b7f2f

SHA256
a09606f3b7786594fe9caec1b4ca5ad6a5dd7c2f349466126910a6913c35b42b

SHA512
45f629fe164b2cb5bb3cfab992ed99ce6f52626170561cb1f0ceaef4c9f92c3c3da61cc0bc2ee3715a194a6ce2c8e73476f7c521c607d7a19944b611542ddb16

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\mt.pak.DATA
Filesize
1.1MB

MD5
71f50a0402bb02a85b86717489521443

SHA1
f87d4521f8746a2d16c53e89e75794fb8f0c67c5

SHA256
11970c55794fc63014ec43b986dbc6060616ddbf18d9f95ad5c5e940d5c0a646

SHA512
627632fe60ab5eea7e50b80531a27e083069f34d653febda9abcfdb96ca733b98684ad2f129019093bf59369687ebebc0f81dda4915477f3f712b9143e9f4529

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\ne.pak.DATA
Filesize
847KB

MD5
7e72ff8b9ce4b89cfa6b156b42505acf

SHA1
3d455fd23609960d2aa525f4994588e15d0f06da

SHA256
6837ceccea9825a153a79d3717704bb1a71c2eb20e085a59e89bb4a40e6d6c28

SHA512
3bca350caa8feaeb2320b41d4febabb24463232b6a7922bc52793d2dbd1bc9c75fa1a10b885cf0794b613dfbb153c27e5894a1bed0e591926799fd9ddece2eb8

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\nl.pak.DATA
Filesize
768KB

MD5
82fc8eeb0bd7cab0aea1644a4e1782fc

SHA1
ac6096e804f4dc0b99132e91071cf441eaa15f08

SHA256
742259f3028de7d7bd80e9837d6d64a46ed746e5a403eb9063a27dfd2cfdc2b9

SHA512
d57d7fe2e59616a793ceaeba6c3e29728119a90455cd7e0c701070d925265d934a67b9ac401652873760f47c68ecbf2839582917ada08f7007272c66bb98b9bf

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\pt-BR.pak.DATA
Filesize
1.0MB

MD5
6b029993dab89d6499d2934fc39b0d60

SHA1
0df5b5a1c8aa592110cd6e9ba9ef543c804ba887

SHA256
739fc70c287b7024e6f2df2406de37cc8f8b5c3992960f9ec95d7942548a3a90

SHA512
89bddbcfa86ae5c4a181eb71b3a41d74260034c2a8a2e8a8bbfef3e9d5ea6513de0ad22e89eb0a12e429fb7bcc420e20688775b35f489c2bf2558b896bbefe21

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\qu.pak.DATA
Filesize
1.1MB

MD5
b5a97f9ed9fc20064cf6527f2bc0e41c

SHA1
a56e2abae303b0c3d346d0964cea8a851bc920f9

SHA256
6ba189509f55f3c946c972e8b6f3c618a3e0ccef0055b477c0b31c680fff37fd

SHA512
35c5a3724f8493c059d49d71e48644fd53ebd41db86c9b8a36c518a4bfcb813aa699ba07ad96e9358c2b9f06770fcb142489aca803392a99bfb0d7f773c160a2

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\ru.pak.DATA
Filesize
832KB

MD5
f2135d31001848f2960051fcc188d101

SHA1
b536813f3d44f21e37e7a72a7f03c99fed887614

SHA256
f07c3be8c71b8539d448be3bcfd6f20ec937b5e9dadc0e6cb17c06c09e8abdf2

SHA512
d1a9b973b262c8e3fb1317587c6adab28c720126bf6155019d04d5363fd2ac07ff758a82a609f599851e9aa354523d7c9e5478ab6dc73d60d27488d14750960f

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\sr.pak.DATA
Filesize
1.6MB

MD5
9ac1aa3cf15871f850d6762a6745736e

SHA1
ea31f8113060c4efb65927934c5917fb67404a63

SHA256
fa675f3f4780c5a2ca0435335ddb9691a5592c747b311e40d5ee8c6e20e240bc

SHA512
e274d00cdbf21abd636e21975e60233a1fd7db279394b7137b69211c67d67b7d40bcc03aa728988376c134495f6fc924c20ce5569c11dfc46d0b5c113a656f8e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\ta.pak.DATA
Filesize
1.1MB

MD5
8f2296825e7fd2470a73d7d5beddc37a

SHA1
697347ac5968fcbba55389775b01f55c97397203

SHA256
6bfaa1c69ecd9f984d1e412ab7214c27aa19172aadab4cd4eaee2e8112fdca14

SHA512
2e0c8e82e797a8ad6bef7ce18972648e792b6aa0c69c78a44b0f3bea222505b0d2f244b2ee1c929d1e4af3bed60b17ef74596414ea09a74ae6aa6a5cd0706474

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\th.pak.DATA
Filesize
960KB

MD5
537bb0c9abd4aa4a406562d0d6c2d35e

SHA1
f67c02020fe0392b83a39cb60ef3e049d9043f3e

SHA256
43b6d0a627600b72dc698905af3bc61315be5aac800bdefa7e73fd1b8b2d05f5

SHA512
7dde8096e8db6385a2ee0aa76ba1b17a1bf1c48fcb52fc75eb1d731c0ee88d299c373a0f8b7dad7271a48010866122beb53c004c23225566add025cfcce14136

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\vi.pak.DATA
Filesize
1.2MB

MD5
1c8ba106e8fc57a7bc08c3fa9179d367

SHA1
b5bf95560e1398921a68593628286a7aba32a964

SHA256
adbea83f94d7c8e77cc84d76e0de6cbf705b2a474176bf34861c3c373ed55881

SHA512
cadfb1c471388c95f574a53c4a3ae1c003c88c0bde3b1d516bf037521ee88c21c20cc99a0a7c8e2b4ba47d45e2ae8e5726fa6b80dacaa76c38a56add58cea1e6

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\zh-TW.pak.DATA
Filesize
881KB

MD5
ddb1b5ff1b961aa1ee9162eaa99897fa

SHA1
9c9ee150f09c3b00475310d8facb1d23fa37fbe5

SHA256
458ba319d318acf0055e02cc3227798cfa4aefb3af13b58fc5b51807426d2aee

SHA512
a140bf4c4f2b4f16bc88b3b60988066fd7a7026a9fddb2f1d8c797f3c80a5fe9d09ee1646aa3447c04d34f74876d1e283f7c6af4e54352f2bf41def45b615fd3

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\MEIPreload\preloaded_data.pb.DATA
Filesize
9KB

MD5
2506eef3a424cabcdcc79542c6fafeb8

SHA1
8546785cf1e6cd13be2e4d6fe1f783c6af0dc94e

SHA256
2d953b749d9c4d8146ac0622e616e5a9d75969dc782803df10181cdebb7d79f1

SHA512
2f9691b8bbecce0f8dd2e90345ebd499c4a1d2c953e52acaccaa8e858977a9e13ef97797469b1e0d131e5ed052bee060c8b2ef14340a64658a0a29321ec43555

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Notifications\SoftLandingAssetDark.gif.DATA
Filesize
160KB

MD5
8d780d4687b0c612313114f4084df1c1

SHA1
a7406e2889cd315140079122c3485517bccf5433

SHA256
f5a79aa239d7e815f2457ca819c69dea682f98c5031ed81033ac48ed3cd05066

SHA512
58a9eaa8ff755ce8e6c7e18999c31355351710f9a460edcac59102615adeea04ec063750144055f3cb82d09af06bed5b16249fb17b342e82942bf0a708e7fb4c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\Advertising.DATA
Filesize
26KB

MD5
f89ab32b1514854819a637a1a23c8343

SHA1
d896b7d47256e49a19b8b1af1f2401471bbb1af8

SHA256
77acba56cea12c1c102f5aa1140b87b7538b753d7458285cadb653fffc122458

SHA512
9d81b16cc8433265db2500f76452596363c40c577f677e218b07a9495147822b816cd39cbcf9781e6ac75303758683e2b40465528a1d4bedc6974d936fe91874

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\Analytics.DATA
Filesize
5KB

MD5
4930f66cdb201efd8303836f25b5625c

SHA1
ba4fb7308a4c547781505255aa0dfcf354675e9e

SHA256
da5b45b36ce6f7ac3abc115e9b115de38a46b36d9663d90ce3f820832dda1b55

SHA512
1d34c9b580e15c58afa3bf22c576ae2889a325c40729c8ad8c8821338b0409597bff6138de016098ad7b79134794db56a34e68ba5cacb374babd76d1e2f77e5e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\CompatExceptions.DATA
Filesize
2KB

MD5
a048fbe53b3a6ac70e7f2e5942a033c2

SHA1
0e82c8bb7e6718ca25d6f8717c612ae47d7ad255

SHA256
1dfdc2b0cb8b728dcbdd5e35931f35fec47e72fb630f58d5992fe0d2a52a93c7

SHA512
9335b187efa552f52fc94cea66be495135f0302f1e8d4886f6391dbb027da8751475169b2fffe40f84b12d3f9e0df0fb533071383d8fe7f57bc22913a431d41f

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\Fingerprinting.DATA
Filesize
2KB

MD5
eda95c237bfafcecd450f1ce344510c3

SHA1
3548d76d2ccbc12889d0d5e65be096eceb23ae7a

SHA256
25e0efd337819b3a35deeea96c58b4166b9507a43c7dd9487821e4e63fcc1cf5

SHA512
98bcb5801e31ad38ee113d678db5159ad10d39709dbb1355a40d6087f7531fd7eddf15265f9619c885db7b0061eab2c46128af54ba1dd5b2a1b117286f6f57e4

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\Other.DATA
Filesize
1KB

MD5
1fea775298c70c1f0b445e0ab66f6518

SHA1
9f3b6a98f4b48882cfed8b928cd5cc6428eb4402

SHA256
b73627ba5e73859f26b885d032563a31429386f49b4f74f1b793e76504daa844

SHA512
ad327875f60bfef78ec65aa86093512427cebbc789ba864afff57c833e51a83e3a97f250005339116a4458807f1b814e95390a151fe62df1b5e793ad0174a9ab

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\TransparentAdvertisers.DATA
Filesize
1KB

MD5
ab60b6f51b513c59d9d1eedd54d41989

SHA1
92be137d703de543ffea611c29d93056a4a3bf70

SHA256
95737b71167055fbb05f34c5aff342b895422292ed4dcac1a398a8b1b1a544b3

SHA512
2f4d5f3ca55179e857164868de1b94702f0bee575b95c41417419dea9c48de36bb9fa521e6e8b981892aaed96d780b0c868525b0dd37f3d812757e6ad4ac7722

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Sigma\Advertising.DATA
Filesize
2KB

MD5
b20d3bf607dc77f67c57de5e639c772f

SHA1
fb6b167e70e2ebe1c7014da6f428277f2bcf2af6

SHA256
0ce6f9248c58811ac405abe4cce467bec8ae3207459f06dbb3f9276831c25f10

SHA512
bd8e84c27798182c15340913206f333af7cb8aa92e9c1ae9c59bcc6f5db484fec9b20b89f526b9ef9a62f9ff285d1c6a179dc90c0ab22fdb13a75613727fe8e1

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Sigma\Fingerprinting.DATA
Filesize
1KB

MD5
e17b08af9c321c1bd1516166bc552b8d

SHA1
fac6831df6eada7227af69dea489eccffd6e805b

SHA256
786a9358ef1dddc76fe17e5d8d57f7f489fc44f38b03c4e891efaa8abe178014

SHA512
d05c0d6c21c96510b4b3fd44d5a253c7d426ac02c1a480f4a52474a95afb3971d2838acc94b7ae94fc7fdc6a932b7fc0b65657b99999c0cf360ab13453325d76

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Sigma\Other.DATA
Filesize
1KB

MD5
bc6ff5c981bd72af39be42d3fa35dac2

SHA1
c6eb06cca6eda0ce754d3a266bb461d8d3a47a53

SHA256
e3eb15d936350e3baeb37d2107f6bd4e17ddbddb3946a45ac05b3450b4898b04

SHA512
215bad187b1fec8fd72c6e3f56cf2de86175e6dbaa5f3c457027995583d7c186d140a8117b3ea5bd6780f666c6781a9c905b62cdd1c99004fa2f5ec912094278

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Sigma\Staging.DATA
Filesize
6KB

MD5
b0cc2e864cc86373029a631df8a5e904

SHA1
f41d876e93d53b7787f782785d3706d0b6926412

SHA256
307eae1f4a6c3c2fd8727a4c6738dea0f2d11fbd6c6b5597b357a90f09a15355

SHA512
1a527fad0368bc483e5065e615c6570cb78a757de6331c80b7ec2715c46efaeeb30c9b178dccb9f48f6f4ecd93dd36dfbc8f32a11de4d49061fa50da5f3bc20d

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\WidevineCdm\manifest.json.DATA
Filesize
2KB

MD5
7941870589a14d01dabaa541f7d4412b

SHA1
867710d0ace5cf859b73cd9e7f01bd47ef3fd1bc

SHA256
d4c1d34574b4699be4babef945011bfee046c41771823aca027d2ce7999c3bd3

SHA512
551cafe322ef8fbb8164d9e2ce4419038afc7f4490f3688fe80bc215feb90141051d92b8187265eef8400bb841857413b3890fbd5b52997bed6c2c2cb9ec1ed9

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\edge_feedback\camera_mf_trace.wprp.DATA
Filesize
25KB

MD5
41c2d18a37c1c324d6a25fd7a5d8fb0f

SHA1
c7fabeddd7914cf2e5ebef03a2b077a2ed4b0717

SHA256
479255a5b0f2d63a15621c6f72ec55a0610a4292158d8c5a03f4db7d2074206d

SHA512
94253dff261d47cd0f8ef21ee925a874bcda9414da15fd0342a25ff0046a7e58f8ef98fe34c40b015a89d4f8f6c06757b9579fcd16620fff6ec663b1907995c5

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Beta.msix.DATA
Filesize
54KB

MD5
21e90e5618e86a2383ce1e4eda8e7ab3

SHA1
93a4a6c972a7fe152e7c8f8072bf91f83a5bc419

SHA256
efe9519a4ddb4cb9404fb7838610fe5d1d4d57d90daff94596bf0078cf105572

SHA512
c0d40f8310ca2cec5e509904e6d89a0088b9173bbed56125632e10aabd018df2333ecc3cb5ca36b381f03f0ecc879314997602fa8a33e4621492483af14d4ea0

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Internal.msix.DATA
Filesize
58KB

MD5
6cd1f5fff7420672a28f05bc5499afc7

SHA1
735aafac5c3e8c982921c424e86b86f0500dad37

SHA256
549922efa974c6891c4d26a4225cb5896feab3179b58ada76debb6853fd58571

SHA512
60d120a99e93ee7174cc2c17e4d3f9972522ad2102815b0579423d9694ff58ee123ab94551fc5646e6afa1988988e5da197921f31220de224c53de8202e76cb9

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Canary.msix.DATA
Filesize
54KB

MD5
9926a048b333ab12407f7b7e96efa54e

SHA1
41258047539320822143d715fc0baef18baf5fae

SHA256
cb848a4f7600805d76dabf6b6b05754ed16ef57c6d8f9d5a9c055289c4a674d6

SHA512
b1375c1229f589347cf39db7959b22f59ba63a87180617a87b040380d209fe0eceb683758685ff5b40d8323cd992de85f1c9e4ea423894061aa6143c1e576f8d

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\msedge.dll.sig.DATA
Filesize
2KB

MD5
967d1c10134867e7389ca70eecbe483d

SHA1
3ef9597cc9aed5ea1b784f917bb0408b0d072b92

SHA256
fea99fea66d6e5bfa817679e945b89f4ead8bc5a8c91fa23506c3ef1f40fc836

SHA512
a28d042a91c1aba8a5403f6abeccd5b11966f421d9f8f019cf84182f2c678256e264e7054d267392a6f951dac8a1f33c9131a4eeb14ca2af1a3662e7b1037304

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\msedgewebview2.exe.sig.DATA
Filesize
2KB

MD5
8d24d96672a709546e5dc496edf9c41b

SHA1
8c38f7be95abc88d1638fe266f9ca9c12ad8edb5

SHA256
46b02d71e16d777ede76d75e1fb02ceaa73ce59aa7d32514e429fc7d3d249d92

SHA512
f5cc2defe9333df6d4a295227a73d86a0ae28988d0b1fd5c4844d9bef3b73e380d3ed271fc83fd257d38ff5c9dfcdc62a041a2c048791baf3f71d1d7cd9d017c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\v8_context_snapshot.bin.DATA
Filesize
671KB

MD5
c91749aedd896c69909b49ab74a2b827

SHA1
d46e15b8ef09922e0798b88462c6c4633786a2bf

SHA256
61a098b7ae0305407af67a785a81c173774a8e5c129f38c48b60c5824db59091

SHA512
60483d1d6eaedbdbc867bcbd51050482f8540979c8562a3057d021ce9cf2d8c91448b1450a3b84f6f2fc821841164948c37cc84e75fb601f3a51ed301c0cfd0e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\vk_swiftshader_icd.json.DATA
Filesize
1KB

MD5
46e5f5339c062b1a558bb69d83d4d6a3

SHA1
3e4d6b4d189e1687b8df1467a0cb767fd9ccae32

SHA256
29a6a4a43e252b6c022cb8383382a9c1f4a83e4536fa4a4b7be2035bb0840e04

SHA512
2311dc2f6323a1f6118dca36692936f7960b6731559260f5d830d593fd7f4404c2e5d4b8b2eecd4cd5377b524ba0f75f9586522f839c312b2dfd02f309633998

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Mu\Content
Filesize
8KB

MD5
1eb17a483e5fe6373e59d0eede2ea1ce

SHA1
603e820621bc3e6cd8425c6d5d9fa65e40bb88b3

SHA256
156371ecaff538211849ddd9d86079509755e2dca48fd8c4a48fcb03ceeed86d

SHA512
5444805f2feefa6f162f61d2b5858d5954c42276d288132d0d4d15858b45ab5904175c0c1d43637d5f9f9b2a232d7374c64dd49540f17bd2376b80709a6428d6

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Mu\Cryptomining
Filesize
2KB

MD5
628e3eaef8a83266eeed42eedbdc99bc

SHA1
79ebcd94150d59d253e164fe2b9597d577ee1e80

SHA256
fac69e6922e9416dbac4bb05d8bd36c7ea19768afc5152c02812d9e78b3f9b05

SHA512
404cc40ef69a3bb356178c6415d12e0abbf17c4ad8761711e5b8b30c9654009277a396518d66edc650e34712e3579d11dc8e522db662c3003039aeb106492daf

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Mu\LICENSE
Filesize
35KB

MD5
45df71296a8167f115fee7edd5f199f8

SHA1
8f185279b5f001acdde981af4b86d107db990c4e

SHA256
774f1c1b3138baa9d5718d3711686ae8ab3603f69daf84b60c3dc2208044aca4

SHA512
d417175cb7778d816937ae8a0f76952da0d84583b8ae851dc17ad87d824051037c35305dd8af28eb554f203df39d57a5a87402db0275d5e7fe941144fa382b4f

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Mu\Social
Filesize
1KB

MD5
cc2fe70550848c50ba23fa4bc43f6624

SHA1
f918859f74ed3dfde9a8aa0fa0e38711d2026aa6

SHA256
21fb669c31cf967def9e6864ab02a113405cee934ed734d7e85f4cb01e554b35

SHA512
99b1974c85a0cccb40982e12557420985194ee5fae44df39763a568a214bc38c17fe028fcaf00f84a1e1c02a53c861e748d55392808dae5991128247fa1f8125

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Sigma\Content
Filesize
1KB

MD5
57c6d1d5159c107e2ec55211eaf6b47a

SHA1
d383061b883be20536c56482ab68bfa5ac524da4

SHA256
9f0cd0c738a16b4d7c4a5d6fe1af777a04f43a7088e49c9c4d52b4d9df9e490b

SHA512
bce92fafc523ece6fe0c77e349b4f5f70d0c0b3135ae3dd04f346ab712d890d6652916387c5d5bed01a6e253e1f2efab8b664e0765466310120eee2da7a5146d

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Sigma\LICENSE
Filesize
1KB

MD5
309e3c99957b7819bd29a572ba2076b8

SHA1
099870bc2ddce4a138d9efe7220574c8aadda6ef

SHA256
afdd8683106dc5b2791fe6dafbf69fcab0b11354d883bbd487e4a2520d30a1f9

SHA512
65196a53cec8dc803a8708e894416d575e60d543f72642237cf0a0d1cbbbfb981a1b6f7298f7bd60f77918c619b46a9c75b1c947f8c43e1ffdcd9a114c311d21

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Sigma\Social
Filesize
4KB

MD5
ebe96f0ea72f8c349a4d1c21be7a83bc

SHA1
a7cc5d4828819ba8eee5ff126a9cfbd17d0401d5

SHA256
ddd843b84e806757e5430d08b15c121fc6614d6b582a873a2061274cfe57919b

SHA512
8aa23f904eb73b3ae81912e30d5143938c7dfe3e601646a35aed6284d9eeedfc066dac01feadd688b1d2b1bde49859fd0294ffe2dc5a837a278d2f7332d291fa

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\manifest.json
Filesize
1KB

MD5
2bb46780062368fd02778c9849f62830

SHA1
fc079ce811044c372ca359a47488d0da37d251db

SHA256
558ee81ba79be2c518d3e9b02189a9f22a5b40e1c0a15e271325a9de17686405

SHA512
7be7cbe601a778dc464f9987984abd137d043dc49e330a2e5167f11fa896ab8733913bc38e3c08beaad07e8dc6f30cab5009c0cc828e378cfeaf23360b07d681

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\VisualElements\LogoBeta.png
Filesize
30KB

MD5
12e20477850d76df860520dbad3fe3ae

SHA1
a168f045b88b7024b008f6c805deba9b1749afcd

SHA256
1367dea8620e86fb5557c8bcdba8b05a6501bc204b78e19b85a25cb0a813d98a

SHA512
0eef83394e00cd2b8a76b3816a81a8c4a1d3c162e380137ec2449679523ca8512e6a1b1463255889aee2c985c0bc977c1334032919a43dc0a06fa2c1347bebb4

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\VisualElements\LogoCanary.png
Filesize
30KB

MD5
9b7432e959c28630e04169bcaa129bc8

SHA1
a2435608d1f21fea29db7849facbc01c79f4ce50

SHA256
755b7d135890ee12e9de86c36e13a947350da499fd917d5c5c1fe8e5ac5c4546

SHA512
7f8cf76cb2667757ca369e0d35d329d05914e5ef9bab472b14dd6c4f908e8e4740c05fcbd9f0a5dac654e247e6e2f122b591c532c0100b6576f314d19d5fea49

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\VisualElements\LogoDev.png
Filesize
30KB

MD5
835bca31b7c545750fb1f8e577d900e5

SHA1
ac5c0c460f65d025a5ecf65f81208a21354d367a

SHA256
ed49f4e82e4b5df074bcdfa489964ac171924c5913d791f4ae19ca6cd02d65b1

SHA512
c1ee2da35a489b01ddbd09bbb0a66c2255a212c985c087a2ce4dcae84243e07bb8ed8192e07282e9882fac24202ff6040700e2092c7e930ad70f835833f44e45

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\VisualElements\SmallLogo.png
Filesize
16KB

MD5
3456bb43db8234d239f17fbc965d9eee

SHA1
bfa00b3f3c11f8d6f9e31fcd10590f40bd77a1af

SHA256
e4546a95724eb4ff2498df9b5c5dd737f4294f703f5af9e52997826e6c49be5f

SHA512
da69ae0a32d379b007bee1003c3b5a8a371f35b87f3395577cd1405e18d8c1f4c559e99f041690ece5904726d57211c5b0a229e063610b3ebdf76d695bb8ff6f

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\VisualElements\SmallLogoBeta.png
Filesize
16KB

MD5
b3c390cd6e2eb623229193df6833bf1d

SHA1
afc2e8d679d6c0f3b534f5b551f491ee7e2247a9

SHA256
9c0e00c4dc1d2fcee5325d3722fa95a71635a3897641ea33a75b63b82aeb31a0

SHA512
ed643cf5c522127beb33ac55ce7887d35d353b249ff86d32a8eeb3e2cd57f64af04c151a2609fba18d64c32335ec1b96ccb22e525bedd34dfa9a9edff0331498

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\VisualElements\SmallLogoCanary.png
Filesize
15KB

MD5
c364a1e7b855eeccadef86c0696e1f34

SHA1
9560bd941804d5378127987c44841feee8cb3b10

SHA256
031d198f8acb153b4124b0c9c1cab167dca9c1d17ee504ac32f88091b3a64262

SHA512
4d6ab1e78370e0c64a34d9b039ecd7178262c50e3b5c1166ebd28838a81633530e85bbed202db7868a98170d2d70726de7a51fe73c9c9143b93c69519c5a1bac

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\VisualElements\SmallLogoDev.png
Filesize
15KB

MD5
a9515ca6e4eae61507bed137f075a360

SHA1
f99bf57f41afcd51985dbc984e295956a1d0cfcc

SHA256
8a110e97778885d1836fd4c4e0ae9a14c9c19c202f302d9520fbf8717c70962f

SHA512
057ffe0b38412ca39656a29bf36042369c3a1ea8ea4b33427702a99394d453931942e4c06f09141c340d4c51e8a168434ddd5bcfc4c5af2d7d15d5a3ecfe4edf

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\[PabFox@protonmail.com ].3uiGl4Rw-e9pocSet.FOX
Filesize
1.1MB

MD5
9c624eae4da8cb6489abcfaeb0a6cd7a

SHA1
41595e67b7b589d07ed588492b786614180cb617

SHA256
456105e59c3960a3b2679e0a9d3324723f3b979bf51e41c2a7e64a1c9244fcee

SHA512
11229d6bceda166089b502a28fd8318c2203922a2a3f9fb4666cb9f5f86b5b1d98da8a7936a1149f30a6ecc7fde8443ff045bca81eb54ac8a4abf5de10fc134c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\[PabFox@protonmail.com ].sAXzqVbR-nl2Ra6eV.FOX
Filesize
256KB

MD5
b338f970cc3397c8b7e2a7e1b3d71a17

SHA1
db32408cb5221a9395f9ceda6aecf78f6e967026

SHA256
1f31dfc07facd29b97eac9bd2228335107f7f3e0f9f40f1bf7fd95c805788946

SHA512
21bc0bbf452fb43f47cb739b4c3571dfc416829713dbdcd165f0ac96d8e2bc7af13aab4a58d9c58a3bff455c3bfafd992f50efa8bac3c6917bf8abe48c29e59a

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\edge_feedback\mf_trace.wprp
Filesize
13KB

MD5
b22638c5afb1dce689a48db9e2014755

SHA1
54e2b6b8bbd93e285bf7f5ffae383320ff1aae0c

SHA256
457c4bf4f15013ba0dce17e09d74ef8d8c2e021b0fb41b7035cf008f52d20bc2

SHA512
d6d5f769548b0bc432067849777962fa8838bd5e59ba3e11a33c032ff192e4651e2aa9acf726633cb7c7b5c8fd0942d8e922b61ffb5f8fc9f35437bec32a7307

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win10\identity_helper.Sparse.Dev.msix
Filesize
54KB

MD5
da6e0e72853100a6fb978409336b2508

SHA1
9607c6b24ed0951c617860aabaca4851672a2a23

SHA256
3d43cf8f5de625706929ae629802622980f5b3d9d1c13e998bc45e327a4d538c

SHA512
5608c919cb375b3cd54755f0a58d96ceef51f470c22aafe47159a3580ed464be1ab6e7ba729cf8d57bd35fcf90f3c6e7516e2cee24ba7103582b7163d616d5b4

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win11\identity_helper.Sparse.Beta.msix
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win11\identity_helper.Sparse.Internal.msix
Filesize
58KB

MD5
5d75edb54c223dd44987747c6e1da7a6

SHA1
7e947b31f7c3bf015e020b9cd6d67d28968faa73

SHA256
60be1fb885dd6df829860c4de8c1f816e40b2e6f362410b25d3908d8c766c32b

SHA512
2c94d76e5964bd4db4c3f94a09ad3fe0311d31c64539ad757f0a635e286d1c447e7a2b5c05d6488a2b6c1b26dab99b4f7ae420b4c10427851f9adbbafc1a057a

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win11\identity_helper.Sparse.Stable.msix
Filesize
58KB

MD5
ce1475e265eb839993810a4e07ccd6f7

SHA1
4c7462d6c1dde240cf7c15be551408a068d3baf5

SHA256
45101de593b75cbfe7ca2fab0311a73f9d69bbcbff68b1aef0b976d1a807b29a

SHA512
8a11e2bf2262e6482c7d4e0bca6fdb212ed497d5900736a4039d4b835e091d95ae9af3b5dc0a7eea935dd3245f63957c7714e8fdf622dd16046b29b65101b0ef

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[PabFox@protonmail.com ].3REINyGB-BdVKpvjW.FOX
Filesize
970KB

MD5
65b1e52a11842c77895c12901f46e268

SHA1
4b692a5492b6ebedb6122dd9458e3fb808845fcd

SHA256
986c76bb7bb5c046bc7c38ae30f1512d424456d6b93a26659788037886bff216

SHA512
3c08a8b3978ffec4185b9ad53f98b452b0839248b451a8ec6ba50dd1fae55c27d8c7f91b873730a77890c6f74146472cb4d1e2e5e3dc6f7f61cce545e44b4885

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[PabFox@protonmail.com ].5G4q1i8B-FCvbBJRJ.FOX
Filesize
1024KB

MD5
f397faafced85b550118e80eaf6f9c1d

SHA1
78e1190aacefd0d976f1c3458dde33c176c189dc

SHA256
80efd55c50484be30cdf23b2c97e72f6c9671ba66e932aaeb3c8bbd3517a3f9a

SHA512
44fb8d3412c1b918b6fd5f025c16093b3bca51131a0fadc73beb8e0482df5fc652a4d31c7d2776764e831658923831464a023fb47a884399ce7a672360850b15

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[PabFox@protonmail.com ].6G5QMd1t-VRNclcDc.FOX
Filesize
1.1MB

MD5
8177394331543bcbbf16f1514ade97df

SHA1
c2ae26f7fdfa85c9fc1767c740978dfab966b05f

SHA256
19a20e036f0c16be77d396be8ac14aaff9e4e3ce4cfd5cb18b35f85f02a926f1

SHA512
7ec0d8312e290e2d8887dca2d5059f5ee4e57010a794fe7504664fa81dc66bbd06aabe493a83b11c9197fc435ea0d1c5b7c5bafb002b316dc15e6a63ca982df3

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[PabFox@protonmail.com ].HeI30kaf-7YSAD4Bs.FOX
Filesize
1.2MB

MD5
16e22df298c6df670a8a1f47685b4f33

SHA1
4165faea2870b1ee7de81fb155daf8a0a6418ca0

SHA256
8ff36b8ac3386f2adcc3133cdca5becd4028d96e3e949c76c9fc7ac4da6a72df

SHA512
27a10452f4710495f12ad94ef8ef4eb574947ebcbb1b77144e3d400bb00356821887cfa7d121b62d12669f987b0575a51e0c615e02682563a466d278f5243212

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[PabFox@protonmail.com ].Oojr7E1R-u6zMRsgB.FOX
Filesize
192KB

MD5
217e52dc7cbedaddeea4324a774a1343

SHA1
ad5cd2bddda2bfe87bf85dd41fbe8afd277f2a7c

SHA256
34208c3794cd01c835141bbf416a869433d93d4f06777c662f9aab39c2bc0537

SHA512
99995388b0b623b5aee1fa4c476a0a03a6ef07a4a8a05f50bd23c2e58becf814759e2df5e3d3b3661b7050779247d3f26f4200307cead4a3ac5483970dbce47f

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[PabFox@protonmail.com ].QOjbcQiC-gaGaxc73.FOX
Filesize
1024KB

MD5
0d915962219bb814e03a8ef4a34dccb5

SHA1
66ee139fb2aa594e5fe2111a25e4f69da8294f90

SHA256
5ed56f5661676933b104cc6028ae1f7e4f41268056d913c54b81a51856af7643

SHA512
bb1676ab7a4800f9c94caaa7e5b05229172d5e03b4c206af37526331df798527c2b25e60b1238021d0bfbda6cc5f0b71438d60e045a39c5855f1052ddc5b9fd8

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[PabFox@protonmail.com ].bCQVUUGW-OANfrGXW.FOX
Filesize
1.0MB

MD5
b1baf2654b7e35368199dd2248d125b0

SHA1
c21650f2e8073529cee7abc52ffbe540437740c9

SHA256
d1910a9ff1382d2debdfed4037b1d6683165a09bd281547821ad3da2539bfac3

SHA512
cc79f39a8e6d69caa367949fe83fb80c81c1022fbe1437052a0c230010750104cf582aba86799ce6dc3d032df8a96012ca0202dd2e2611ef795db1f5e67d680d

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[PabFox@protonmail.com ].oF62dHT0-3owKKeqD.FOX
Filesize
1.0MB

MD5
1513701437f2f8859066631e2f148ae5

SHA1
c4dbfbcf1495e5a04b4771bf67febf53f236562a

SHA256
61dbb267bb6c93b090e421d24409a4d08d6e664c2e95dd8db37c937dfae6d559

SHA512
ff18400969e1cadba8d99d8e0c2e8de31891ea11e3fb3a38e972f7c8d55af45562c7aaec47fa7e7c44855636bd64ea3c32e65363c940654bbbed7b82f8f24188

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[PabFox@protonmail.com ].sb14ueJ9-Xuuyl4fM.FOX
Filesize
1.9MB

MD5
6c90ae49d3885055695df31694f1af7b

SHA1
67317c68b75295720d7257999d79f1b5eaad0a46

SHA256
9f09d7e99f3a6aa460e5ac9ccb86fa02217f1413276bb0daa2839b2d32e5ec03

SHA512
7581cb5ff8db765e95dd36eabe55b5e9d423498d627e7b8fa9112c9f26fd266025af096b77e98bf9d69b3285dbebf81cf30a09040f75234b2e117b9ab3ce0be4

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Extensions\external_extensions.json.DATA
Filesize
1KB

MD5
39d78479f5e20b5a3d6a709f05f0e17a

SHA1
5142b4c80bf854cfee7dcad3c8e97f63261e07ca

SHA256
12453b9c24701362edbea00a833613df802b08bf197f1b246eac4e6ee454119c

SHA512
50a9b9446d2e6a2ff7e8ed4ebb80c29970e1281863275987f4ee7398c3235c788f088da1850c44a99e2bd68f7a02d0627b3eccfc459b22d2a619f5ee8e89f9ad

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\[PabFox@protonmail.com ].NaTv6R7F-ouXQYhJp.FOX
Filesize
448KB

MD5
45aab98edaf5a1ac052e90e036b240b0

SHA1
bc20c9f239dfba6e0d22dc94cf22d699dd152587

SHA256
d609a06cdc2f296a6fef7ec2b11ce472d3dbfee6a50f40bd8923d56842a3d702

SHA512
d28ec8c06e8ff916748fa0065a69e42d80d8ea9f2d6b794dc00b666c549972962bef9143a71a5e3eb222fcf9c440311b967adc48a84c066d8b6ea54465a82340

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\Sigma\[PabFox@protonmail.com ].Q3Ze2SRu-xoWkPEvG.FOX
Filesize
1KB

MD5
5b679831df6a3cd45f392d6b276c97d8

SHA1
36a5f3351020648c64ba78c9267ce739e46b54b7

SHA256
dbdd0ec50a09bd31b1c8f4a7309f601935f23c32d6f817e78bf2dc2097b4ba16

SHA512
0869e52b15acd7b801dd15ba9fcb22d529f3d75dcc932b017c20c62c09f69a2880a4352120afbe3e33bab89b7c97b24705827043689ad9abc832c4678ebcb832

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\[PabFox@protonmail.com ].WTelgBtD-MiMXt3gF.FOX
Filesize
2KB

MD5
e7babad0561d4542cb50539deaccaa8e

SHA1
5e48b82b64cc541750f96e2bc8b680998b72be0a

SHA256
97e35fb04887909b448c3510496aecdbabf8822d6bbd7674377a2ea3afcd531f

SHA512
6f07b07e74b27321ac03fd56bab9462fc2f68ca106bc83b645145e9c0374f998353dbe3bb9d67f6c8b3603f52e4d4d2ae3d63aaa135b2be1bf0efafbec4736fa

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\[PabFox@protonmail.com ].3i2ZI6o4-QydtDa1d.FOX
Filesize
384KB

MD5
6661d8e6b80d72a40044e55511d085f4

SHA1
84cacb5d91df32e99ff7a3cecb280abf1965eb0a

SHA256
ff88af5f7de0a82094020cc9a2479dd8185236d95010eec2c7a21cb6d1dac4c9

SHA512
9a44c0b31027314aadae537c208b1674715dba583ed494fc657285e995f607109bd9f71f05917a70d01321a955af579d48e006ccd60904a38e54966d5ec80379

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\[PabFox@protonmail.com ].PqgLC8Mt-U8gddWQJ.FOX
Filesize
9KB

MD5
97c8d22197c10e0f7c6217d7643736bc

SHA1
26971dbb69551ff14de4c0c42ae05d7b8e66da6e

SHA256
e07cf1f6ea2d39ef327507c4887c0f6e13474dbd47e66330d92f3762c7d70903

SHA512
524a375124b14cc6dd64516db201b21a2af1819d9136b031397502ebaded16c000b36f30b21c5f2b038e88c71a1c4f0279620f1faa87eef2bc8379a646c9b7cf

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\[PabFox@protonmail.com ].cnZowkN9-mhKDXLES.FOX
Filesize
14KB

MD5
23cc8329ac8afac1a793343dd851c41c

SHA1
a9c2a95af5c80c29e764db56f56337ddbf322548

SHA256
f442ec67c152fdefdaae07bc3ffb3983f22cc0d7785413efd2dd19398418cc7f

SHA512
1eecd5e017eecea17733499c1285f86689325336124792c7c14420a98eb801335b1ff24a4bf158dd9a6374128b8619c2f96c2b2c43cc56c772dc3dc7c2960788

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\[PabFox@protonmail.com ].w9R0JmJc-8maNpRXv.FOX
Filesize
19KB

MD5
6bd14329ee23b5fa943c58677d1e401b

SHA1
fadc0f94877a511e3cfc2763a6f43030a9c57838

SHA256
ee15e762014d2ada818015662fdaaa151afc1b215d34ad16a65a6a2a22df7e3d

SHA512
875e8123d57571739a7b62dffc76e539707af592c9d45400bfa36b37a9b55a09d7a68c24dd550c102c7615a183cbc9d0f782ad2b291c93fc1196d6492d7cf5de

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\[PabFox@protonmail.com ].yUMuUOg5-7XxAFoEY.FOX
Filesize
2KB

MD5
04bb9e437c32fb98ef6c69c378397940

SHA1
42808fd0d79778fbb1a8b0c1ab0eec4ce49020f2

SHA256
3bbf683aba810a482643ea6f67e91e65b612d40ea4e97725db65035f617221f4

SHA512
ed05c696e61ecd41be1fd5a8e5a1d263e24fd865f682b02819a382c6744b86ae12d24bced9be96e4c676c439498a51f10d37e45457effc97d3315899cb80e395

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\[PabFox@protonmail.com ].9mdKdzOi-FIxhlsGQ.FOX
Filesize
5KB

MD5
d331a0ff26a21129bac72a15e50ef0eb

SHA1
7701a76b93e816e3e74117bc02b723c2ab711041

SHA256
1cc0d29023f40e535dbd7637a3cb2266144560797c58ef7f10c5d662c3e74699

SHA512
cc1bacbd224748fc1fda255e179457a2b0b89d1c8a5cbd14ce486a6af26d913962166970c2267b0e4b53f1e109614b5df1db9506120218161d968f1fcb4656a4

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\win10\[PabFox@protonmail.com ].6oAno9a9-pDGlpO2I.FOX
Filesize
58KB

MD5
0af5869120ea4a18b4877b6596ecdc1d

SHA1
9209a65a3907c0cea210d4f6c40a4c9e09c5d77d

SHA256
f6e8970374e09b562301adcdd8c5fa7ac6d1491c90467394723745d7e87f16d4

SHA512
ea61af88cee3f804aaa1ff4b9244c131f6f6ef34439bdd3d8082004756f9779182ddbcd40ce5b91fb077f294950d3501d72e6833d4ea6c07a927e5127b74134e

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\win11\[PabFox@protonmail.com ].uA5mpXFR-GmSsVgt1.FOX
Filesize
54KB

MD5
7201f60c60275c7e675fc89e1c087b8c

SHA1
73e2ed53724032235ad82aca9c3cf1e8b6473278

SHA256
49b234064f02a3bc16eb8f21f65df2b2ca19c036424c272f92f12515508acacb

SHA512
8458c315ec3ac2732e5f5b356704a024eba7ee21ffd57c9bc543e25a3f60d438976695803062b69cc27ac2510f7265f12a3253bf17f82eb6d037679425c87796

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\notification_helper.exe.manifest
Filesize
2KB

MD5
f6dc27b7d113612d3b3cfaddac816516

SHA1
9dad0ad03821ff87f008b7bf5f193f11cfe7615e

SHA256
8c5c689fba230564e161b142897574d53e0208a406cb60d5130bd921e1e460ec

SHA512
f6da84382177b68118120aacf8eb420727d62786c99e0d6aa370e4faeac714aa5ecd5f54c868981e4d5f71016887af8f762beb3e00f2e47ecf6e0fba8cff801b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
9babfeb1586f5fd1edd66d8bb72975c6

SHA1
1537c39351b14bc222be126c767d2249ba47432b

SHA256
1f621ee4337f8ef57ffaa75ad17535920699d1af8b78385ea788dd8c1fbd828a

SHA512
d153c283f935a3fa403280a83ee9c21ef3bcec3f960ed89fc09b857e74fd1c339f5e1035c489ba4b56477a20fd1317d6a090fdde42e45adbb232e6774c565aad

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NW87G6Z4.exe
Filesize
1.2MB

MD5
1fa1b6d4b3ed867c1d4baffc77417611

SHA1
afb5e385f9cc8910d7a970b6c32b8d79295579da

SHA256
91d07adbf35edb6bb96e7b210f17b9b868ed858802727d6f69c1e5a2d37a9c53

SHA512
0600b92914a7489a6428b8e4217e5f24e1d149fc5807d86cc4de91b43be2470a1ddf77093c8732d4371a87fd163cc556e09d11a2c6655382a35a5f5741ae05a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\YYcYgdAC.exe
Filesize
181KB

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\eDprqtTA.bat
Filesize
246B

MD5
9c120c1b01c44cf3d87a5496c26280b4

SHA1
9149af5a9166a13415a419f48bfa74358c510115

SHA256
17300dceeea0afc182c4541ebc294b553599c19ccefee459041144c6255ca992

SHA512
8be3b6280ecef70d2fb23b143b9cc74755c1f52f044665c919d55686820d60a0a59f10f5ae22595023f784de5b338e6a6e381fa76d82a03447fd7a68efa264c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\elog_65E3711449E2627A.txt
Filesize
2KB

MD5
ca3397b49bdc384547fca3bad4966da2

SHA1
beac9f61053cdd65707494081a560f1936a0846d

SHA256
95afdc35dc26860ee90ac628157d00dbfdfc1f65515818552270db4cfc16feac

SHA512
9e8bee8cbb38447f77896e4f58cae3f03576263e9e4f4f39b1c22f46a66054e5cdc207528cb0d5b619d5e156bdf5321e63b0baba7983447278d83d51845f6e1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\elog_65E3711449E2627A.txt
Filesize
1KB

MD5
3d4712f2eefb18d7ef77f1a74a5c2158

SHA1
4f1bad1b44a236a4b9d680160e6286054a968100

SHA256
2d808daa692a85e3dca0b57e73536fabb8a934ad1e5887605dbd57c6670981ff

SHA512
0969511166f98e521aa2cc19ca6401084b5b61741a9b8288c105c90e4423eae41f81df57de11f8a0964603d632050534707914c27ce77b35128e37bb2a86e7fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\elog_65E3711449E2627A.txt
Filesize
27KB

MD5
1300d2e02dbcea0c0988116a506c61c2

SHA1
4ca5f630a5a6a261f4baeb969181b5de8bbf4a5e

SHA256
5c73810379b915bc2eef28bf07912891dd46276848e6ecc0ebdb8c6f40d65907

SHA512
bdc283cf3ab3fe03a08b06172930d38a0f51385c567520908e250f13b272fcebec2af062c07d27c72839305752e809f96c8469eb9ddccbd031b4977a931c7ed3

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\elog_65E3711449E2627A.txt
Filesize
1KB

MD5
92c1b24ee175301d049b756e1d3d1a68

SHA1
e7856c925f9b50d97acb1728723422bc4f56f778

SHA256
d78ed4298d8cb97e724a58c7fe97ee96ee8dacd4a754381e931004edbe932022

SHA512
508e75693abdf3b9218748e55ef3d1dd78e39946bb50a6b7a956e3a30e6bab01e651e39bec10483057de0fa7c2a922505240e57f0f6b0b8473c9ab929140db79

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\h2LvQqlB.txt
Filesize
16B

MD5
17d432845dc7cb55ac69d75cf72f7f5d

SHA1
7f3b6e6ab91b3a13c0611fe6e95befab691d5cc3

SHA256
a7cd0523e7aca4fd8db39d49ce1fe6198b92956509bd360dae646798c2a251a4

SHA512
25054cd4ec03675f28d0aa1aa09b691beacb9f9a1cf538179777d74a713e97457c39d56c787becc378fcdc31c62cbdf56546f8cee41f5f99f11b8798663104e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\YYcYgdAC64.exe
Filesize
221KB

MD5
3026bc2448763d5a9862d864b97288ff

SHA1
7d93a18713ece2e7b93e453739ffd7ad0c646e9e

SHA256
7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

SHA512
d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mf1o0mvv.0x2.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\NRkRVF8m.bat
Filesize
265B

MD5
6ed16dd4791f9d8418f0d607909c1af8

SHA1
f7df851445e20e73aa524aa280d12c004b9e6c58

SHA256
ad88c5fc67d25215093828925a95f5ac5a46f4b7e68e425cae447a8177ed3128

SHA512
a8bd940cd8d0b2008a5321c209040f9691b53bd77747eb07d41e55dd79dae44d14c6b5def28f5d20ceb9726c01d799d05eaa5f5a407f783d902d79ce9184a132

Download Submit
C:\Users\Admin\AppData\Roaming\X9OSRutf.vbs
Filesize
260B

MD5
21599b27ff627cfe33395282f0033a6a

SHA1
d334c342561ddff70b6381ef9e66ae708e6ddd9a

SHA256
0082cd1bef4a09e900b03751702b51daae48dd42ecf540ad2d3aed89d5bab176

SHA512
5e2521ea9900e29268d1632e8db525c8eef674d8ed1be408794213b1eaf773e4393aaf5f0af2c1af4b6ece389f604cbf695a06b43f106e09da47cc031ca27400

Download Submit
memory/440-10511-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/440-9599-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/440-9-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/440-1468-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/440-7-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/440-11964-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/440-3773-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/440-16957-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/440-9246-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/440-13100-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/440-20150-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/440-30-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/440-8564-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/440-7197-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1544-1121-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1544-9530-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1544-7934-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1544-8-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1544-12469-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/4232-16-0x00000000061A0000-0x0000000006206000-memory.dmp

Filesize
408KB

Download
memory/4232-33-0x0000000006D60000-0x0000000006D7A000-memory.dmp

Filesize
104KB

Download
memory/4232-15-0x00000000058A0000-0x00000000058C2000-memory.dmp

Filesize
136KB

Download
memory/4232-31-0x0000000005350000-0x0000000005360000-memory.dmp

Filesize
64KB

Download
memory/4232-32-0x0000000007ED0000-0x000000000854A000-memory.dmp

Filesize
6.5MB

Download
memory/4232-14-0x0000000005990000-0x0000000005FB8000-memory.dmp

Filesize
6.2MB

Download
memory/4232-13-0x00000000052B0000-0x00000000052E6000-memory.dmp

Filesize
216KB

Download
memory/4232-23-0x0000000006280000-0x00000000065D4000-memory.dmp

Filesize
3.3MB

Download
memory/4232-12-0x0000000005350000-0x0000000005360000-memory.dmp

Filesize
64KB

Download
memory/4232-10-0x0000000074440000-0x0000000074BF0000-memory.dmp

Filesize
7.7MB

Download
memory/4232-36-0x0000000074440000-0x0000000074BF0000-memory.dmp

Filesize
7.7MB

Download
memory/4232-17-0x0000000006210000-0x0000000006276000-memory.dmp

Filesize
408KB

Download
memory/4232-28-0x0000000006880000-0x000000000689E000-memory.dmp

Filesize
120KB

Download
memory/4232-29-0x00000000068B0000-0x00000000068FC000-memory.dmp

Filesize
304KB

Download
memory/5424-637-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5424-2736-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download